Quasar Linux RAT

... setting up persistence using no less than seven different methods, including systemd, crontab, and .bashrc shell injection.

The malware supports extensive post-compromise functions including shell access...

It dynamically compiles rootkit shared objects and PAM backdoor modules on the target host using gcc, then deploys them via /etc/ld.so.preload for system-wide interception.

... setting up persistence using no less than seven different methods, including systemd, crontab, and .bashrc shell injection.

QLNX also implements two PAM backdoors that compile on the target system, enabling credential harvesting and authentication interception.

... setting up persistence using no less than seven different methods, including systemd ...

... setting up persistence using no less than seven different methods, including systemd, crontab, and .bashrc shell injection.

The persistence subsystem includes seven mechanisms such as systemd services, cron jobs, init scripts, XDG autostart entries, and LD_PRELOAD-based injection.

QLNX also comes with a Pluggable Authentication Module (PAM) inline-hook backdoor that intercepts plaintext credentials during authentication events ... The malware also supports a second PAM-based credentials logger ...

... setting up persistence using no less than seven different methods, including systemd, crontab, and .bashrc shell injection.

... receives commands that make it possible to ... inject code into processes ...

QLNX also implements two PAM backdoors that compile on the target system, enabling credential harvesting and authentication interception.

... setting up persistence using no less than seven different methods, including systemd ...

... setting up persistence using no less than seven different methods, including systemd, crontab, and .bashrc shell injection.

The persistence subsystem includes seven mechanisms such as systemd services, cron jobs, init scripts, XDG autostart entries, and LD_PRELOAD-based injection.

A userland rootkit hides files, processes, and binaries by hooking libc functions via LD_PRELOAD, while an optional eBPF controller manipulates kernel maps to hide processes, files, and ports at kernel level.

To evade detection, QLNX disguises itself as legitimate kernel threads such as [kworker/0:0] and rewrites process metadata visible in ps, top, and /proc.

... receives commands that make it possible to ... inject code into processes ...

QLNX is a powerful Linux remote access trojan that runs directly from memory to avoid detection, hides its activity using eBPF, wipes logs...

QLNX is a powerful Linux remote access trojan that runs directly from memory to avoid detection, hides its activity using eBPF, wipes logs, and checks whether it is running inside containerized environments.

... is capable of profiling the host to detect containerized environments ...

... to ensure that the implant's artifacts and processes stay hidden ... conceal processes, files, and network ports from standard userland tools such as ps, ls, and netstat ...

It dynamically compiles rootkit shared objects and PAM backdoor modules on the target host using gcc, then deploys them via /etc/ld.so.preload for system-wide interception.

QLNX is a sophisticated Linux malware designed to operate entirely from memory and avoid leaving traces on disk. After execution, it copies itself into a RAM-backed file using memfd_create, deletes the original binary, and re-launches directly from memory using execveat or /proc/self/fd/<memfd> as a fallback.

QLNX also comes with a Pluggable Authentication Module (PAM) inline-hook backdoor that intercepts plaintext credentials during authentication events ... The malware also supports a second PAM-based credentials logger ...

... wiping system logs to cover up the tracks ...

The malicious code can steal credentials, log keystrokes, manipulate files, monitor clipboard activity, and create network tunnels for remote access.

Finally, a credential-stealing module extracts SSH keys, browser data, cloud tokens, developer credentials, system secrets, and clipboard content, enabling full compromise of development and cloud environments.

QLNX also comes with a Pluggable Authentication Module (PAM) inline-hook backdoor that intercepts plaintext credentials during authentication events ... The malware also supports a second PAM-based credentials logger ...

The malware then profiles the infected system, checking privileges, kernel version, SELinux status, containerization, GCC availability, X11 access, and support for process injection or keylogging.

QLNX is a powerful Linux remote access trojan that runs directly from memory to avoid detection, hides its activity using eBPF, wipes logs, and checks whether it is running inside containerized environments.

... is capable of profiling the host to detect containerized environments ...

The malware supports extensive post-compromise functions including shell access, file management, persistence, credential theft, SSH lateral movement...

The malicious code can steal credentials, log keystrokes, manipulate files, monitor clipboard activity, and create network tunnels for remote access.

The malware supports extensive post-compromise functions including shell access, file management, persistence, credential theft, SSH lateral movement, screenshots, keylogging...

It collects extensive information, including system details, clipboard data, shell history, SSH keys, Firefox profiles, and credentials through a malicious PAM module.

Once established, QLNX initializes 58 command handlers and connects to its C2 server over a custom TLS-based protocol, HTTPS, or HTTP.

The malware supports extensive post-compromise functions including shell access, file management, persistence, credential theft, SSH lateral movement, screenshots, keylogging, rootkits, SOCKS proxies, port forwarding...

... continuously attempts to establish and maintain communication with the command-and-control (C2) server over raw TCP, HTTPS, and HTTP.

The malware supports extensive post-compromise functions including shell access, file management... and in-memory BOF execution.

QLNX communicates with attackers through encrypted channels... TCP and HTTPS are protected with TLS... In the default raw TLS mode, QLNX uses a custom length-prefixed binary protocol after disabling certificate validation.

If no commands are available, responses remain empty; otherwise, Base64-encoded payloads are decoded, dispatched via a handler table, executed locally, and results are returned to the C2.