MITRE ATT&CKsoftware (malware)
S1078 RotaJakiro
- Domain
- enterprise
- Platforms
- Linux
- Version
- 1.0
- Created
- 2023-06-14
Description
RotaJakiro is a 64-bit Linux backdoor used by APT32. First seen in 2018, it uses a plugin architecture to extend capabilities. RotaJakiro can determine it's permission level and execute according to access type (`root` or `user`).
Related
Uses · MITRE ATT&CK (17)
- T1573.001 Symmetric Cryptography sub-technique
- T1132.001 Standard Encoding sub-technique
- T1571 Non-Standard Port technique
- T1559 Inter-Process Communication technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1546.004 Unix Shell Configuration Modification sub-technique
- T1543.002 Systemd Service sub-technique
- T1547.013 XDG Autostart Entries sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1037 Boot or Logon Initialization Scripts technique
- T1041 Exfiltration Over C2 Channel technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1095 Non-Application Layer Protocol technique
- T1106 Native API technique
- T1119 Automated Collection technique
- T1129 Shared Modules technique
Referenced by MITRE ATT&CK · uses (1)
- G0050 APT32 group
References
- https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/ RotaJakiro 2021 netlab360 analysis
- https://blog.netlab.360.com/rotajakiro_linux_version_of_oceanlotus/ netlab360 rotajakiro vs oceanlotus