RotaJakiro — Malware Profile

RotaJakiro is a 64-bit Linux backdoor used by APT32. First seen in 2018, it uses a plugin architecture to extend capabilities. RotaJakiro can determine it's permission level and execute according to access type (`root` or `user`).

MITRE ATT&CK techniques (17)

• T1036.005 Match Legitimate Resource Name or Location
• T1037 Boot or Logon Initialization Scripts
• T1041 Exfiltration Over C2 Channel
• T1057 Process Discovery
• T1082 System Information Discovery
• T1095 Non-Application Layer Protocol
• T1106 Native API
• T1119 Automated Collection
• T1129 Shared Modules
• T1132.001 Standard Encoding
• T1140 Deobfuscate/Decode Files or Information
• T1543.002 Systemd Service
• T1546.004 Unix Shell Configuration Modification
• T1547.013 XDG Autostart Entries
• T1559 Inter-Process Communication
• T1571 Non-Standard Port
• T1573.001 Symmetric Cryptography

Attributed threat actors

• APT32

Read the full analysis on IntelFusions