Sneaky Linux Malware Exploits RAR Filenames to Outsmart Antivirus Systems

At a glance

• New Threat: A Linux attack hides its malicious code inside a RAR archive’s filename to slip past antivirus tools.
• How It Works: When a shell script processes the filename, encoded Bash commands run and download the VShell backdoor.
• Who Uses VShell: The backdoor has been widely used by Chinese hacking groups, including UNC5174.
• Defenses: Security tools and scripts that handle filenames need to catch this kind of trick.

A payload in the filename

Researchers at Trellix have found a Linux attack that hides malicious code in the filename of a file inside a RAR archive. As reported by The Hacker News, the attack starts with a spam email carrying the RAR archive. The payload isn’t in the file’s contents, so antivirus tools that scan contents miss it.

How the attack works

Hiding code in a filename

The filename contains Base64-encoded Bash commands. When a poorly written shell script or command processes the filename, the shell runs the hidden commands. That starts a downloader, which fetches a loader for the victim’s processor type.

Running in memory

The loader then downloads and decrypts VShell and runs it in memory. Little is written to disk. Traditional file-based scanning has almost nothing to find.

What VShell does

VShell is a Go-based remote access tool. It lets attackers run a remote shell, manage files and processes, forward ports and communicate with their command servers over encrypted channels. The Hacker News reports that Chinese hacking groups, including UNC5174, have used it widely in recent years.

What defenders should do

Better detection

Signature-based detection can’t catch a payload that lives in a filename. Behavior-based monitoring is needed, watching for shell commands that decode and run data.

Safer scripts

Linux systems have long been seen as less exposed than other platforms. This attack shows why that is risky. Admins should check scripts that loop over filenames and make sure they quote variables and never pass filenames to eval or similar commands.

The takeaway

The VShell campaign turns an ordinary filename into an attack. Patching won’t stop it. Careful scripting and behavior-based monitoring will. Treat filenames from email attachments as untrusted input, just like any other data from outside.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.