A recently discovered Linux malware with backdoor capabilities has flown under the radar for years, allowing attackers to harvest and exfiltrate sensitive information from compromised devices.
The backdoor, dubbed
RotaJakiro by researchers at Qihoo 360's Network Security Research Lab (360 Netlab), remains undetected by VirusTotal's anti-malware engines, although a sample was
first uploaded in 2018.
RotaJakiro is designed to operate as stealthy as possible, encrypting its communication channels using ZLIB compression and AES, XOR, ROTATE encryption.
It also does its best to block malware analysts from dissecting it as resource information found within the sample spotted by 360 Netlab's BotMon system is encrypted using the AES algorithm.
"At the functional level, RotaJakiro first determines whether the user is root or non-root at run time, with different execution policies for different accounts, then decrypts the relevant sensitive resources using AES& ROTATE for subsequent persistence, process guarding and single instance use, and finally establishes communication with C2 and waits for the execution of commands issued by C2," 360 Netlab said.
