RotaJakiroMalware
RotaJakiro is a stealthy Linux backdoor which remained undetected between 2018 and 2021. The malware uses rotating encryption to encrypt the resource information within the sample, and C2 communication, using a combination of AES, XOR, ROTATE encryption and ZLIB compression.From MISP Galaxy
Last reported 10 months ago, by Huntress1 report
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“MSTSC tunnels Remote Desktop Protocol connections, defaulting to port 3389.”
- T1036Masquerading
“Process Masquerading”
- T1543.002Systemd Service
“Persistence was established by creating a hidden directory to blend in with legitimate systemd services.”
- T1552.003Shell History
“Interactive Shell History Prevention: When spawning a reverse shell, the ZinFoq immediately executes the following command:”
- T1572Protocol Tunneling
“FTP Proxy allows file transfer protocol tunneling with support for both control and data connections.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182“RotaJakiro, Pink Botnet… Is This You?”
Indicators in its reports
named in the reports above- 38.165.44[.]205in 1 report
- hxxp://38.165.44[.]205/1in 1 report
- 45.76.155[.]14in 1 report
- api.qtss[.]ccin 1 report
- hxxp://207.148.79[.]178:6608/sys.shin 1 report
- 207.148.79[.]178in 1 report
- hxxp://216.158.232[.]43:12000/sex.shin 1 report
- 216.158.232[.]43in 1 report
- hxxp://45.32.158[.]54/5e51aff54626ef7f/x86_64in 1 report
- 45.32.158[.]54in 1 report
- hxxp://45.76.155[.]14/vimin 1 report
- hxxp://keep.camdvr[.]org:8000/d5.shin 1 report
- keep.camdvr[.]orgin 1 report
- hxxp://103.135.101[.]15/wocaosinm.sh;wgetin 1 report
- 103.135.101[.]15in 1 report
- hxxp://103.135.101[.]15/wocaosinm.sh;shin 1 report
- hxxp://vps-zap812595-1.zap-srv[.]com:3000/sex.shin 1 report
- vps-zap812595-1.zap-srv[.]comin 1 report
- hxxp://help.093214[.]xyz:9731/fn32.shin 1 report
- help.093214[.]xyzin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.