360 Netlab Blog company blog

RotaJakiro: A long live secret backdoor with 0 VT detection

by @TuringAlex blog.netlab.360.com published 2021-04-2811 min read

Overview On March 25, 2021, 360 NETLAB's BotMon system flagged a suspiciousELF file (MD5=64f6cfe44ba08b0babdd3904233c4857) with 0 VT detection, the sample communicates with 4 domains on TCP 443 (HTTPS), but the traffic is not of TLS/SSL. A close look at the sample revealed it to be a backdoor targeting

Points

434

HN comments

174

Submissions

1

Cited by

0 commenters

Security & PrivacySoftware Engineering2021

Related posts from the same era

No Cookie for You

The GitHub Blog20202,941 points609 commentscited by 30 details

When you browse Instagram and find Tony Abbott's passport number

mango.pdf.zone20202,326 points446 commentscited by 9 details

Apple's plan to “think different” about encryption opens a backdoor to your life

EFF Deeplinks20212,260 points824 commentscited by 11 details

Someone is pretending to be me

Connor Tumbleson20222,244 points383 commentscited by 3 details

Oppose the Earn IT Act

Mozilla Foundation20202,229 points543 comments details

Whistleblower: Ubiquiti Breach “Catastrophic”

Krebs on Security20211,944 points785 commentscited by 9 details