Loading malware…
DinodasRAT, also known as XDealer, is a cross-platform espionage backdoor associated with China-aligned intrusion activity. It has been observed in operations linked to clusters aligned with Earth Krahang and has also been reported in activity attributed to LuoYu. The malware exists in both Windows and Linux branches, with the Linux variant commonly tracked as Linodas and used to target server environments including Ubuntu and Red Hat systems.
On Windows, DinodasRAT has been deployed in targeted spearphishing-led intrusions against government entities. Document-themed lures have been used to deliver an archive containing a malicious executable that installs the backdoor. Once active, the malware supports broad remote administration and surveillance functions, including screenshot capture, clipboard collection, file transfer, registry manipulation, process and service control, command execution, and interactive shell access. It encrypts command-and-control traffic using the Tiny Encryption Algorithm and can communicate over TCP, with support for UDP as an alternative.
On Linux, Linodas is a mature server-focused backdoor rather than a simple port of the Windows codebase. It establishes persistence using operating-system-appropriate startup mechanisms on Ubuntu and Red Hat families, daemonizes itself, stores configuration locally, and generates a unique victim identifier. It maintains encrypted communications with its controller and supports extensive remote operations including file management, process enumeration and termination, service control, command execution, reverse shell access, proxying, self-removal, and collection of logged-in user activity from standard Linux accounting sources.
A notable enhancement in later Linux versions is a companion filter component that replaces selected system binaries and suppresses output containing attacker-defined values, hiding malicious artifacts from common administrative utilities. This behavior gives the Linux branch rudimentary rootkit-like concealment capabilities in addition to persistence and full remote control.
DinodasRAT has been used for cyber espionage against governmental and regional targets and has been reported targeting Linux servers in multiple countries. Its development shows code reuse from publicly available remote administration projects, but its operational use, persistence mechanisms, encrypted communications, and concealment features make it a capable long-term access platform for state-aligned intrusion sets.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
This actor’s toolset notably includes a cross-platform backdoor named DinodasRAT, also known as XDealer... In this blog post, we share our full technical analysis of the latest Linux version (v11) of DinodasRAT, which we track as Linodas.
This actor’s toolset notably includes a cross-platform backdoor named DinodasRAT, also known as XDealer... In this blog post, we share our full technical analysis of the latest Linux version (v11) of DinodasRAT, which we track as Linodas.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
Since a domain ending with gov.vn indicates a Vietnamese governmental website, we believe that the operators were able to compromise another governmental entity and use it to host their malware samples.
Operators made custom malware for the operation.
Operators have used servers to upload malware.
Earth Krahang that has targeted 116 entities spanning 35 countries by leveraging spear-phishing and flaws in public-facing Openfire and Oracle servers to deliver bespoke malware such as PlugX, ShadowPad, ReShell, and DinodasRAT.
Earth Krahang that has targeted 116 entities spanning 35 countries by leveraging spear-phishing and flaws in public-facing Openfire and Oracle servers to deliver bespoke malware such as PlugX, ShadowPad, ReShell, and DinodasRAT.
As the first step in breaching their victim’s network, the threat actors behind Operation Jacana sent the target organization spearphishing emails referencing Guyanese public affairs.
0x18 Execute a process and send the response back Process path to execute | 0x1B Reverse shell start... 0x1C Reverse shell restart... 0x1D Reverse shell close... 0x1E Write to reverse shell
execute CMD commands, and more.
DinodasRAT uses APIs, e.g., CreateProcessW , to execute CMD commands on the victim’s machine.
The spearphishing emails contained a link that, when clicked, downloaded a ZIP file from https://fta.moit.gov[.]vn/file/people.zip .
Once the victim extracted the ZIP file, which wasn’t password protected, and launched the contained executable, they became compromised with the DinodasRAT malware.
The persistence process is quite extensive and covers multiple Ubuntu versions and RedHat distributions... achieves persistence by one of the following methods: Method 1 (Ubuntu) – rc.local enabled via systemd... Method 2 (Red Hat) – init.d script... Method 3 (Red Hat) – rc.local
The persistence process is quite extensive and covers multiple Ubuntu versions and RedHat distributions... achieves persistence by one of the following methods: Method 1 (Ubuntu) – rc.local enabled via systemd... Method 2 (Red Hat) – init.d script... Method 3 (Red Hat) – rc.local
Most of the samples we found have the name ntfsys, apparently attempting to masquerade as a system or driver file related to NTFS.
The extracted filenames are related to the phishing email subject lines: Guyanese fugitive in Vietnam20220101to20230214Guyanese fugitive in Vietnam.docx.exe
0x2E Self-fully uninstall, remove persistence, kill the parent daemon, and exit
If all three arguments were passed, DinodasRAT terminates the process represented by the process ID using the Windows API TerminateProcess then uses the Windows API DeleteFileW to delete the file passed in the third argument.
It then changes its file timestamp using the following command: touch -d \"2010-09-08 12:23:02\" [SELF_FILE_PATH]. This timestamp is also set to other backdoor-related files such as the config files when accessing them.
the latest version introduces a separate evasion module to hide any traces of malware in the system by proxying and modifying the system binaries’ execution... filter any values, such as IP, username, process name, or other artifacts, from various information-gathering binaries such as who, netstat, ps
The Application Doc directory is created with the attributes Read-only and Hidden.
0x10 List services on the victim’s machine.
0x12 Get info from a Windows registry key.
Thread #1: Logged-in user monitor... monitors logged-in users using the who command... Thread #4: Logged-in users monitor and logging... its details are logged and sent to the C2 server... 0x0F Enumerate logged-in users
0x0E Enumerate running processes.
DinodasRAT sends a packet with basic information about the victim’s machine and its configuration, such as: Windows version, OS architecture, username, malware execution path encoded in base64
0x02 List the contents of a specific directory.
Take a screenshot of the display of the victim’s machine every five minutes using Windows API functions like CreateDCW , BitBlt , DeleteDC , or ReleaseDC .
Get the content of the clipboard every five minutes using the Windows API function GetClipboardData and save it in the subdirectory Application Doc\1 .
The mode field serves as the type of C2 communication to use, TCP or UDP... the malware sets up a socket in TCP or UDP mode, based on the configuration, and attempts to connect to the C2.
In order to communicate with the C&C server, DinodasRAT uses the Winsock library to create a socket that uses the TCP protocol. Although TCP is the default protocol used to send and receive information from the C&C server, we have seen that DinodasRAT is capable of changing to the UDP protocol.
0x08 Download a file from the C2 and execute it... Thread #3: Filter module download and setup... make another request to the C2 and save a newly received file
In some cases, the encrypted data is further encoded with base64 before being sent to the C&C server.
DinodasRAT encrypts the information it sends to the C&C using the Tiny Encryption Algorithm (TEA).
To send the stolen information to the C&C server, DinodasRAT crafts a packet containing the following
0x14 Start/Stop service Service name, action type... 1 – start service 0 – stop service 2 – stop and delete service | 0x12 Kill process Process ID to kill
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.