Previously undocumented and stealthy Linux malware named RotaJakiro has been discovered targeting Linux X64 systems. It has been undetected for at least three years, and operates as a backdoor. Four samples have now been discovered, all using the same C2s. The family uses rotate encryption and behaves differently for root/non-root accounts when executing. The malware supports 12 functions, three of which involve specific plug-ins that are downloaded from the C2s. The researchers have not managed to access any of the plug-ins, so cannot comment on their purpose. However, the functions built into the malware can be categorized as collecting device information, stealing sensitive information, and managing the plug-ins. The researchers do not yet know how the malware spreads or is delivered.
All discovered C2s were registered in December 2015, suggesting the malware is possibly older than the confirmed three years. The stealthy nature of the malware is partly down to its rotation through various encryption algorithms while communicating with its C2 servers, using techniques such as dynamic AES, double-layer encrypted communication protocols to counteract the binary & network traffic analysis. There are two stages to its C2 communication. The initial phase decrypts the C2 list, establishes a connection with the C2, encrypts and sends the online information, and receives and decrypts the information returned by the C2. The second stage is to verify the information received from the C2, and then, if verified, to execute any commands received. Persistence and process guarding are handled differently for infected root and non-root accounts. For process guarding on root accounts, a new process is automatically created when the service process is terminated. On non-root accounts, the malware generates two processes that monitor each other. If one is terminated, the other restores it.