A New Multiplatform Backdoor targeting Linux which does not have any known connections to other threat groups.
The Linux binary is a statically linked ELF file, while the Windows binary is a dynamically linked PE file.
Both instances of this malware are practically identical in terms of overall functionality, with minor implementation differences. However, if we pay close attention to each instance we can draw some conclusions regarding the nature of the authors.
Both malware instances share the same protocol to communicate with the same CNC server. However, these instances have different delivery vectors:
The Windows variant of this malware does not represent a complex threat in terms of Windows malware. Conversely, the Linux variant shows more sophistication in regards to the implementation details used to replicate the same functionality.
This indicates information regarding the malware authors’ development environment preference.
The main function is not obfuscated and appears to be straightforward in logic. In the Windows variant we can see how some strings are decoded in the beginning of the function.