Quasar Linux (QLNX): A Supply Chain Foothold with Full RAT Capabilities

SOC Prime Team

Quasar Linux (QLNX): A Supply Chain Foothold with Full RAT Capabilities

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

Quasar Linux (QLNX) is an advanced Linux remote access trojan that combines a user-space and eBPF rootkit with a PAM backdoor and broad credential-harvesting capabilities. The malware supports fileless execution, process name masquerading, and several persistence techniques that help it remain hidden on infected systems. Its focus on developer workstations makes it especially dangerous for supply-chain abuse, as it can steal tokens, SSH keys, and cloud credentials. The malware also uses encrypted communications and supports a peer-to-peer mesh architecture to improve resilience and maintain access.

Investigation

Trend Micro researchers obtained the QLNX binary and conducted both static and dynamic analysis, uncovering embedded source code for the rootkit and PAM backdoor components. Their investigation documented the malware’s ability to compile components directly on the target host, the range of persistence mechanisms it uses, and the full command set supported by the implant. Network analysis also revealed a custom TLS-based protocol and a distinctive magic identifier used in communications. From this work, researchers extracted indicators of compromise to support hunting and detection.

Mitigation

Defenders should look for QLNX by monitoring for its unique mutex lock file, suspicious LD_PRELOAD entries, and unusual gcc compilation commands that generate malicious shared objects. Organizations should also block execution of unknown binaries named quasar-implant and restrict write access to /etc/ld.so.preload. Multi-factor authentication should be enforced for developer accounts, and security teams should monitor closely for attempts to exfiltrate credential stores and sensitive token files.

Response

If QLNX indicators are found, isolate the affected system immediately, collect memory and disk images, and terminate the malicious process. Remove unauthorized entries from /etc/ld.so.preload, delete the compiled malicious .so files, and clear the lock file used by the implant. All potentially exposed credentials, especially cloud and package registry tokens, should be rotated without delay. Investigators should also assess whether any supply-chain systems, repositories, or build environments were contaminated during the intrusion.

"graph TB %% Class definitions classDef action fill:#99ccff classDef technique fill:#ffcc99 classDef malware fill:#ff9999 classDef tool fill:#cccccc classDef process fill:#ccffcc classDef persistence fill:#ffdd99 %% Malware node malware_qlnx["Malware – Name: QLNX Description: Fileless Linux implant that uses rootkit techniques"] class malware_qlnx malware %% Execution phase action_execution["Action – Execution: Launches fileu2011less implant via memfd_create and execveat, spoofs argv0 and process name"] class action_execution action technique_process_spoof["Technique – T1564.010: Hide Artifacts u2013 Process Argument Spoofing"] class technique_process_spoof technique technique_unix_shell["Technique – T1059.004: Command and Scripting Interpreter u2013 Unix Shell"] class technique_unix_shell technique %% Privilege escalation phase action_priv_esc["Action – Privilege Escalation: Attempts sudo or pkexec to gain higher rights"] class action_priv_esc action technique_priv_esc["Technique – T1548.004: Abuse Elevation Control Mechanism u2013 Elevated Execution with Prompt"] class technique_priv_esc technique %% Persistence phase action_persistence["Action – Persistence: Installs systemd services, cron @reboot, init.d scripts, XDG autostart and LD_PRELOAD hook"] class action_persistence action technique_rc_scripts["Technique – T1037.004: Boot or Logon Initialization Scripts u2013 RC Scripts"] class technique_rc_scripts technique technique_autostart["Technique – T1547: Boot or Logon Autostart Execution"] class technique_autostart technique technique_hijack["Technique – T1574: Hijack Execution Flow via LD_PRELOAD"] class technique_hijack technique class action_persistence persistence %% Defense evasion phase action_defense_evasion["Action – Defense Evasion: Deploys LD_PRELOAD rootkit, eBPF controller, process injection and clears logs"] class action_defense_evasion action technique_rootkit["Technique – T1014: Rootkit u2013 hides files, processes, ports"] class technique_rootkit technique technique_thread_hijack["Technique – T1055.003: Process Injection u2013 Thread Execution Hijacking"] class technique_thread_hijack technique technique_process_hollow["Technique – T1055.012: Process Injection u2013 Process Hollowing"] class technique_process_hollow technique %% Credential harvesting phase action_credential_harvest["Action – Credential Harvesting: Collects credentials from files, SSH keys, /etc/shadow, browsers and PAM"] class action_credential_harvest action technique_creds_files["Technique – T1552.001: Unsecured Credentials u2013 Credentials In Files"] class technique_creds_files technique technique_private_keys["Technique – T1552.004: Unsecured Credentials u2013 Private Keys"] class technique_private_keys technique technique_shadow_dump["Technique – T1003.008: OS Credential Dumping u2013 /etc/passwd and /etc/shadow"] class technique_shadow_dump technique technique_cookies["Technique – T1550.004: Use Alternate Authentication Material u2013 Web Session Cookie"] class technique_cookies technique technique_pam["Technique – T1555: Credentials from Password Stores u2013 PAM module"] class technique_pam technique %% Collection phase action_collection["Action – Collection: Captures clipboard data and screen images"] class action_collection action technique_clipboard["Technique – T1115: Clipboard Data"] class technique_clipboard technique technique_screenshot["Technique – T1113: Screen Capture"] class technique_screenshot technique %% Command and Control phase action_c2["Action – Command and Control: Exfiltrates data over encrypted TLS/HTTPS"] class action_c2 action technique_exfil["Technique – T1041: Exfiltration Over C2 Channel"] class technique_exfil technique %% Lateral Movement phase action_lateral["Action – Lateral Movement: Uses harvested SSH keys to access remote hosts"] class action_lateral action technique_remote_exploit["Technique – T1210: Exploitation of Remote Services"] class technique_remote_exploit technique %% Connections malware_qlnx –>|performs| action_execution action_execution –>|uses| technique_process_spoof action_execution –>|uses| technique_unix_shell action_execution –>|leads to| action_priv_esc action_priv_esc –>|uses| technique_priv_esc action_priv_esc –>|leads to| action_persistence action_persistence –>|uses| technique_rc_scripts action_persistence –>|uses| technique_autostart action_persistence –>|uses| technique_hijack action_persistence –>|leads to| action_defense_evasion action_defense_evasion –>|uses| technique_rootkit action_defense_evasion –>|uses| technique_thread_hijack action_defense_evasion –>|uses| technique_process_hollow action_defense_evasion –>|leads to| action_credential_harvest action_credential_harvest –>|uses| technique_creds_files action_credential_harvest –>|uses| technique_private_keys action_credential_harvest –>|uses| technique_shadow_dump action_credential_harvest –>|uses| technique_cookies action_credential_harvest –>|uses| technique_pam action_credential_harvest –>|leads to| action_collection action_collection –>|uses| technique_clipboard action_collection –>|uses| technique_screenshot action_collection –>|leads to| action_c2 action_c2 –>|uses| technique_exfil action_c2 –>|enables| action_lateral action_lateral –>|uses| technique_remote_exploit "

Attack Flow

View

## Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

Attack Narrative & Commands:
1. Stage 1 – Payload Generation: The attacker writes a minimal C payload that calls memfd_create to create an anonymous in‑memory executable file, writes a simple shellcode (e.g., execve("/bin/sh", …)), marks it executable, and then launches it via execveat.
2. Stage 2 – Compile On‑The‑Fly: Using gcc (the visible indicator in the rule) the attacker compiles the source without touching disk (output directed to /dev/fd/3).
3. Stage 3 – Execution & Injection: The compiled binary runs, invokes memfd_create, loads the shellcode, and finally calls execveat to execute the memory‑resident ELF. Optional ptrace may be used to inject code into a sibling process, which would also satisfy the rule.

Regression Test Script:

#!/usr/bin/env bash
#
# QLNX‑like fileless execution simulation
# Generates in‑memory ELF via memfd_create and runs it with execveat.
# Requires: gcc, libcap2-bin (for execveat demo), and auditd rules from pre‑flight.

set -euo pipefail

# 1️⃣ Create C source that performs the memfd + execveat dance
cat > /tmp/payload.c <<'EOF'
#define _GNU_SOURCE
#include <sys/mman.h>
#include <sys/syscall.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>

int main(void) {
    // Create an anonymous file descriptor (memfd)
    int fd = syscall(SYS_memfd_create, "memfd_payload", MFD_CLOEXEC);
    if (fd == -1) _exit(1);

    // Simple ELF binary that just execve /bin/sh
    const unsigned char elf[] = {
        0x7f,0x45,0x4c,0x46,0x02,0x01,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
        // ... (truncated for brevity – a minimal statically linked /bin/sh ELF)
    };
    write(fd, elf, sizeof(elf));
    // Make it executable
    fchmod(fd, 0755);

    // Use execveat to run the in‑memory binary
    syscall(SYS_execveat, fd, "", NULL, NULL, AT_EMPTY_PATH);
    _exit(0);
}
EOF

# 2️⃣ Compile with gcc (this will be captured by the detection rule)
gcc -static -o /tmp/payload /tmp/payload.c

# 3️⃣ Execute the malicious binary – this triggers execveat
/tmp/payload

# 4️⃣ Cleanup
rm -f /tmp/payload /tmp/payload.c

Cleanup Commands:

# Remove residual files and unload potential audit rules (if test environment is disposable)
rm -f /tmp/payload /tmp/payload.c
sudo auditctl -d -a always,exit -F arch=b64 -S execveat -k qlnx_execveat
sudo auditctl -d -a always,exit -F arch=b64 -S memfd_create -k qlnx_memfd
sudo auditctl -d -a always,exit -F arch=b64 -S ptrace -k qlnx_ptrace

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free