3 ms·

That everything is a file in Linux does not take away from the fact that this trojan only exists in volatile memory. It’s a fileless trojan for all intents and

• prvit 4y ago
  The Linux equivalent of fileless malware on Windows would be a python script you pipe straight into the interpreter. The whole purpose of “fileless” malware is to not get caught by AV which will alert on a new files being created and executed. If this malware was piggybacking on the actual python process to do its thing, then maybe you could reasonably call it “fileless”.
  • TillE 4y ago
    Yes exactly, fileless malware generally means injecting code into existing trusted processes, which makes it extremely difficult to detect. If your malware can be detected by a simple real-time AV scanner which just hooks file I/O, it definitely isn't fileless.
• rascul 4y ago
  It's fileless because the file is in memory instead of a hard disk? That doesn't seem like a good distinction.