RotaJakiro: A long live secret backdoor with 0 VT detection

Overview On March 25, 2021, 360 NETLAB's BotMon system flagged a suspiciousELF file (MD5=64f6cfe44ba08b0babdd3904233c4857) with 0 VT detection, the sample communicates with 4 domains on TCP 443 (HTTPS), but the traffic is not of TLS/SSL. A close look at the sample revealed it to be a backdoor targeting Linux X64 systems, a family that has been around for at least 3 years.

@fuxoft maybe the haters were right, and linux / open-source software does actually suck... so many years of learning it, useless :-(

Sign in to participate in the conversation