RotaJakiro: A long live secret backdoor with 0 VT detection

Post by laburn » Thu, Apr 29, 2021, 3:43 PM UTC

DelaneyM wrote: post #3

The obvious question not answered (but asked) in the article is: "Who put it there and why?" Surely this should be easily knowable?

Post by IChooseY0u » Thu, Apr 29, 2021, 3:44 PM UTC

ramshanker wrote: post #33

pmoriarty wrote: post #27

What's "VT" and "C2" ?

C2 is "Command and Control" server I guess. VT no idea. EDIT: Someone else commented below. VT is number of scans on Virus Total website.

Post by hiccuphippo » Thu, Apr 29, 2021, 3:45 PM UTC

duxup wrote: post #9

This isn't my area of expertise but ... where did they find this? >On March 25, 2021, 360 NETLAB's BotMon system flagged a suspiciousELF file (MD5=64f6cfe44ba08b0babdd3904233c4857) with 0 VT detection, the sample communicates with 4 domains on TCP 443 (HTTPS), but the traffic is not of TLS/SSL. A close look at the sample revealed it to be a backdoor targeting Linux X64 systems, a family that has been around for at le…

Post by thebigspacefuck » Thu, Apr 29, 2021, 3:46 PM UTC

jozvolskyef wrote: post #22

gvb wrote: post #8

Earlier quoted context omitted.

The user (perhaps running as root) was tricked into installed it. It has nothing to do with the kernel installation. The file name is chosen by the attackers to look like a legit executable - systemd-daemon if installed as root, $HOME/.gvfsd/.profile/gvfsd-helper if installed without root privileges. That way victims who are looking at file names won't be alarmed because they look like an expected file e.g. hiding in…

This is completely off topic but I love the Caesar cipher implementation in your bio. What does HAL stand for?

Post by chrisbrandow » Thu, Apr 29, 2021, 3:48 PM UTC