Two servers, one filename
Two sessions hours apart pulled a file named linux from two unrelated networks, each trying three delivery methods in turn and falling back to a raw shell socket that needs nothing installed. The binary itself carries no settings. Its configuration arrives as an encoded command-line argument, which is why taking one server offline changes nothing.
Two break-ins, two different servers, and the same filename.
Take down the machine hosting the malware and the campaign stops. That is the usual assumption.
Two sessions, hours apart. One pulls from a network in one country, the other from a network somewhere else entirely. Both ask for a file called linux.
Both try three ways to get it. A download tool, then a second download tool, then a raw socket opened by the shell itself, which needs nothing installed at all.
And when the file finally runs, its settings arrive with it: seven hundred and eighty bytes of encoded configuration, handed over as a command line argument.
The binary is generic. The address, the account and the target are supplied at launch. Take one server down and the next one serves the same file.
Log outbound connections. That is where this shows.
#linux#security#malware#infosec#sysadmin
❯ Log outbound connections. That is where this shows.