Description

The gem's native extension is a cover: ext/keccka/keccka.c is an empty stub and extconf.rb — auto-executed by gem install — contains a base64-wrapped Ruby payload decoded and passed to eval. The payload XOR-decodes a hardcoded C2 URL (http://45.138.12.177:8092/wgkit.tar.gz), curls the tarball over plain HTTP to a bare IP, and runs bash /tmp/.w1/wg_install.sh from the extracted content. Execution is gated by anti-analysis checks: it skips when CI environment variables are set (CI, GITHUB_ACTIONS, TRAVIS, JENKINS_URL, GITLAB_CI, CODESPACES), when the hostname matches ephemeral/sandbox patterns (firecracker, sandbox, vagrant), when the username looks generated (sandbox, tester, analys, scanner, uA\d+), when the working directory is an analysis path (/tmp, /opt/rubygems, /workspace), or when system uptime is under 1800 seconds, and it requires developer-looking signals on disk (~/.ssh, ~/.gitconfig, ~/.gem/credentials). On a matching host it double-forks a detached child that sleeps 20-40 minutes before fetching and executing. The destination is a plaintext, unauthenticated bare-IP host unrelated to any legitimate publisher; the fetched shell script is unpinned, unverified, and attacker-controlled.

The OpenSSF Package Analysis project identified 'keccka' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References