QLNX

QLNX, also known as Quasar Linux RAT, is a Linux malware family.

Background

Trend Micro describes Quasar Linux RAT (QLNX) as a full-featured Linux implant that pairs remote access with sophisticated evasion, persistence, keylogging, and credential harvesting. The binary embeds, as string literals, the C source code for both its PAM backdoor and its LD_PRELOAD rootkit. On the victim host it compiles the rootkit shared objects and PAM backdoor modules on the fly with gcc, then registers them through /etc/ld.so.preload to achieve system-wide interception. QLNX goes after developer and DevOps credentials throughout the software supply chain. Its harvester pulls secrets from high-value files including .npmrc (NPM tokens), .pypirc (PyPI credentials), .git-credentials, .aws/credentials, .kube/config, .docker/config.json, .vault-token, Terraform credentials, GitHub CLI tokens, and .env files. Stealing these could let the operator publish malicious packages to NPM or PyPI, reach cloud infrastructure, or move laterally through CI/CD pipelines. QLNX bundles a PAM backdoor that uses inline hooking to capture plaintext credentials during authentication. It relies on the hardcoded master password O$$f$QtYJK and writes XOR-encrypted harvested credentials to /var/log/.ICE-unix. It also features a P2P mesh capability that links individual implants into a resilient network, making full removal considerably harder.

Source: Malpedia (Fraunhofer FKIE).