Invisible Quasar Linux malware found

Invisible Quasar Linux malware found aimed at attacking developers

Developer, or Developer, or Dev for short, is now a difficult life because it has to contend with both AI or Artificial Intelligence, layoffs, many industry competitors, and has also been the primary target of hackers and malware such as this news.

According to a report by the website, Bleeping Computer has mentioned the detection of a new malware on the Linux operating system called Quasar Linux (QLNX). The malware is a cross between Backdoor, Credential Stealer, and Rootkit. This malware operates in environment conditions for software development such as npm, PyPI, GitHub, AWS, Docker, and Kubernetes. In addition to the malware being able to attack groups of developers, it can lead to widespread attacks by attacking the supply chain (s). Supply Chain Attack, or inserting malware into a package (package) software and publishing it through the channel.

In the area of hiding on the system, a research team from Trend Micro, a well-known anti-cyber tool developer, found that malware has the ability to stealth silently lurk on the system for a long time using methods such as in-Memory Execution, removing the Binary file of the malware from the system, removing the log Wiping, lurking in a process that spooks the name of a common process (Process Sproofing), and removing the forensic environment. Variables. In the area of self-persistence on the system, up to seven mechanics have been used: LD _ PRELOAD, systemd, crontab, init.d scripts, XDG autostart, and "bashrc" injections, which will guarantee that the malware will stay on the system for as long as it lasts.

As for the functionality of the malware, it is also divided into seven functions:

The RAT or Remote Access Trojan, which is the core of this malware, supports up to 58 commands to handle the victim's machine, covering Shell Access, File Management and Process, System Control, and Network Management. This function receives commands from C2 or Command and Control via modified TCP / TLS or HTTP / S protocols. Special arrival for this malware only

The in-depth system access function, or Rootkit, is a quiet collaboration, invisible within the system of two mechanisms: Userland LD _ PRELOAD Rootkit and eBPF Component with the ability to access the core of the system (Kernel). This part of the malware uses a hook on the Userland layer to hide all files, processes, and malware-related things, while eBPF hides PIDs, file Paths, and network port (Network Port) contacts at the Kernel level.

Credential Stealer is a function that removes a Credential Harvesting tool that can store various forms of passwords such as SSH keys, web browsers, cloud configs and software development systems, / etc / shadow, and Clipboard, along with PAM-based Backdoor Malware that can intervene with Intercept data for authentication in a non-encrypted text format.

Surveillance functions such as Keylogging, Screenshot Recording, and Clipboard Peeping System

Execution and Injection functions are used to launch processes such as ptrace and / proc / pid / mem, and to run malware (payload) files directly on memory such as shared objects and BOF / COFF.

The Filesystem Monitoring function is used to track system files via inotify.

# linux # Lemon 8 Howtoo # Trending # lemon 8 diary # freedomhack