Security researchers have recently flagged a backdoor malware that targets 64-bit Linux installations. However the researchers report that the malware has evaded detection for at least three years.
Analysis of the backdoor, named RotaJakiro by researchers at Qihoo 360's Network Security Research Lab (360 Netlab), revealed that it enables attackers to harvest and exfiltrate sensitive information from compromised devices.
BleepingComputer reports that the malware isn’t picked up by VirusTotal's anti-malware engines, despite the fact that a sample was first uploaded to its database in 2018.
- Protect your devices with these best antivirus software
- Here are the best firewall apps and services
- We’ve also rounded up the best ransomware protection tools
The 360 Netlab researchers say that the malware uses the ROTATE encryption algorithm and has different profiles that it employs depending on whether its executing on a root or a non-root account.
Once it’s made itself home, it establishes communication with the command and control (C&C) server and awaits instructions.
Stealthy operator
The researchers note that RotaJakiro takes several steps to ensure it stays under the radar, including compressing and encrypting its communication channels using ZLIB, AES, XOR, ROTATE algorithms.
Breaking down the malware further reveals that RotaJakiro has several functional similarities with the Torii Botnet, which was exposed by security researchers at Avast back in 2018.
More worryingly however, the 360 Netlab researchers are clueless as to the true intent of the threat actors behind the malware.
“RotaJakiro supports a total of 12 functions, three of which are related to the execution of specific Plugins. Unfortunately, we have no visibility to the plugins, and therefore do not know its true purpose,” admit the researchers.
They believe their analysis is just the “tip of the iceberg” and the malware will remain a threat until they uncover its true intentions and how it managed to spread.
- These are some of the best endpoint protection software offerings around
Via BleepingComputer
