S1078 RotaJakiro

malwareEnterprise

platformsLinux

also known asRotaJakiro

RotaJakiro is a 64-bit Linux backdoor used by APT32. First seen in 2018, it uses a plugin architecture to extend capabilities. RotaJakiro can determine it's permission level and execute according to access type (`root` or `user`).

techniques used (17)

ATT&CK techniques this enables or maps to.

T1036.005Match Legitimate Resource Name or Location
T1037Boot or Logon Initialization Scripts
T1041Exfiltration Over C2 Channel
T1057Process Discovery
T1082System Information Discovery
T1095Non-Application Layer Protocol
T1106Native API
T1119Automated Collection
T1129Shared Modules
T1132.001Standard Encoding
T1140Deobfuscate/Decode Files or Information
T1543.002Systemd Service
T1546.004Unix Shell Configuration Modification
T1547.013XDG Autostart Entries
T1559Inter-Process Communication
T1571Non-Standard Port
T1573.001Symmetric Cryptography

used by groups (1)

Threat groups associated with this.

G0050APT32

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan