A new Linux malware, dubbed “HiddenWasp”, that installs a backdoor for remote control. The malware begins with a script that is used to create a user account, clean the system of old variants, and download a tarball file from a remote server. This tarball contains the initial deployment script, the trojan binary, and the rootkit. The script executes the binary, adds the rootkit to the LD_PRELOAD path, and configures the necessary environment variables. It finishes executing by establishing persistence via an entry in /etc/rc.local. If the required environment variables are set, the user-space rootkit runs a function to hide malicious artifacts and associated network connections. The binary, which shares strings with ChinaZ malware, has a main purpose of connecting to a C2 server in order to receive commands from its operator. It also has functionality to ensure that the rootkit remains operational. As part of the execution, the Trojan searches for and tries to hide certain artifacts tied to an open-source Chinese rootkit. This indicates the HiddenWasp malware targets systems that have already been infected.
Targeted remote control
Indicators of Compromise
IP(s) / Hostname(s)
Malware Hash (MD5/SHA1/SH256)
Block threat indicators at your respective controls.