AUR validator.malware (stage2 agent linux x86_64)

stage2.md

ELF64 x86-64 PIE, stripped, 3,668,704 bytes sha256 06c857c8ca798d50c765b4de39e6c4f272ecb57bc8316a8ed4c0fdf02fb59502

this is a rust infostealer + interactive RAT + ssh worm. it installs its own persistence, harvests everything of value on the host, and takes remote commands over its own tor channel.

almost all strings are encrypted with ChaCha20-Poly1305, with one key + nonce + ciphertext per call site.

first it checks

• /proc/self/status for TracePid
• hostname against vmware, seclab, sandbox, cuckoo, analysis, virus, vxbox, honeypot, maltest, triage, anyrun, cape, remnux, flare, sndbox, nijin-lab
• CI env (GITHUB_ACTIONS, GITLAB_CI, ...) + CapEff container-capability check
• /sys/class/dmi/id fingerprint: aws/ec2, gcp/gce, azure/hyper-v, alibaba, oracle
• it also references security tooling (volatility, wireshark, clamscan, osquery) and offensive C2 frameworks (sliver, empire, mythic, merlin, metasploit, AdaptixC2).

then it searches:

• browsers: cookies, Login Data, key4.db, logins.json, leveldb, and the chromium/edge/brave/vivaldi/yandex "Safe Storage" keychain entry to decrypt v10+ cookies; firefox/librewolf/tor too
• crypto wallets: Exodus (patches app.asar to inject JS that leaks the seed), Electrum, Ledger, Trezor, Monero, Wasabi, Phantom/MetaMask extensions, kwallet, sui.keystore
• password managers: 1Password, Bitwarden (fido2/cardholder/passport fields), LastPass
• messengers: Telegram tdata, Discord (+api token scrape), Slack (xoxc/xoxd)
• cloud + dev creds: .aws/.azure/.kube/gcloud/argocd/helm/terraform, .npmrc/ .pypirc/.netrc/.git-credentials/.env, GITHUB/GITLAB tokens, OPENAI/ANTHROPIC/ GEMINI keys, Vault (.vault-token, /v1/auth/*), and cloud metadata at runtime (169.254.169.254 IMDS, ECS 169.254.170.2, GCE metadata, AWS STS GetCallerIdentity / AssumeRoleWithWebIdentity)
• IDE/AI: Cursor auth (refreshToken/accessToken), AI service credits
• removable media (mounts ntfs volumes), clipboard history, ssh keys

the ssh worm reads id_rsa/id_ecdsa/id_ed25519 and known_hosts and spreads laterally: scp/ssh with StrictHostKeyChecking=no BatchMode=yes, chmod +x && nohup … &, logging "deployed to". the credential dirs from stage 1 (.ssh .gnupg .pki .cert .password .local .config .cache) appear too.

it copies itself to /var/lib// as root or $HOME/./ as user (name is a random), staging in /dev/shm. it persists using:

• /etc/systemd/system/.service, Restart=always, RestartSec=30, WantedBy=multi-user.target
• ~/.config/systemd/user/.service + loginctl enable-linger
• /etc/cron.d with */5 * * * * root ... and @reboot in the user crontab
• mac: Library/LaunchAgents + LaunchDaemons .plist; windows build also present it escalates with sudo -S and systemd-run --system --no-ask-password, and drops a security.selinux xattr on an anchor file as an anti-reinfection marker read on the next run (same as in stage 1).

exfiltration goes over its own tor: it downloads the tor bundle from archive.torproject.org, writes a torrc with AllowSingleHopCircuits, and runs tor disguised as argv[0]="dbus-daemon", then connects through SOCKS5 on 127.0.0.1. the channel is a hand-rolled NK-style X25519 + HKDF + ChaCha20-Poly1305 secure channel: agent knows the server static pubkey, derives directional keys (csi-a2s/hkdf agent2server, csi-s2a/hkdf s2a).

over that channel it functionally a RAT:

• hello beacon: hwid, hostname, username, cpu/cpu_cores, active_user, os, campaign, version, tor_port, locale, public_ip, agent_name
• keepalive: {"t":"ping"} / {"t":"pong"}
• {"t":"cmd"} with id/command/shell/cap -> bash_run | python_run | python3_run | ps_run (PowerShell, cross-platform)
• {"t":"cancel"} with id/sig
• loot uploaded as {t, loot, type, meta, ts, seq, source, pid, data}

the handshake uses embedded 32-byte key material, sealed: a 60-byte blob (0x45677c) = [12B nonce || 48B ct] that the plain ChaCha20-Poly1305 core decrypts to 32 bytes fed into X25519. the derivation uses embedded strings (hkdf-blob/aead-open/csi-blob:q) and the cached string "x25519_server_pub". the embedded key material is:

key = HKDF-SHA256(salt=root, ikm="x25519_server_pub", info="csi-blob:x25519_server_pub")

the C2 X25519 server static public key and thus IOC to map this campaign is:

2d15205b422f6137ab08c728e2ae0ca38d07b5153723b373d12532d8bebb6a48