Loading malware…
Rakos is a Linux malware family observed in 2016 that targets multiple processor architectures, including x86, x86-64, and MIPS, indicating an intent to operate across heterogeneous Linux environments. Publicly documented artifacts for the family include multiple versioned builds and memory-forensics tooling capable of detecting Rakos indicators of compromise and extracting embedded configuration and ping-request data from infected systems. The malware communicates with command-and-control infrastructure over HTTPS. Available high-confidence information supports that Rakos runs on Linux systems and maintains remote operator-controlled configuration, but the supplied facts do not establish a more specific functional class such as botnet, backdoor, or worm, nor do they reliably document its initial infection vector, victim sectors, or threat-actor attribution.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A botnet family represented among the Go malware samples in the dataset.
The content indicates a GitHub repository path for IOC data related to Rakos, but provides no substantive description of the malware's behavior in the visible text.
Linux malware tracked as Rakos; the content is an IOC repository directory for this malware family.
Named malware referenced as the subject of an ESET malware IOC repository path.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.