Loading malware…
DinodasRAT, also known as XDealer, is a cross-platform espionage backdoor associated with China-aligned intrusion activity. It has been observed in operations linked to clusters aligned with Earth Krahang and has also been reported in activity attributed to LuoYu. The malware exists in both Windows and Linux branches, with the Linux variant commonly tracked as Linodas and used to target server environments including Ubuntu and Red Hat systems.
On Windows, DinodasRAT has been deployed in targeted spearphishing-led intrusions against government entities. Document-themed lures have been used to deliver an archive containing a malicious executable that installs the backdoor. Once active, the malware supports broad remote administration and surveillance functions, including screenshot capture, clipboard collection, file transfer, registry manipulation, process and service control, command execution, and interactive shell access. It encrypts command-and-control traffic using the Tiny Encryption Algorithm and can communicate over TCP, with support for UDP as an alternative.
On Linux, Linodas is a mature server-focused backdoor rather than a simple port of the Windows codebase. It establishes persistence using operating-system-appropriate startup mechanisms on Ubuntu and Red Hat families, daemonizes itself, stores configuration locally, and generates a unique victim identifier. It maintains encrypted communications with its controller and supports extensive remote operations including file management, process enumeration and termination, service control, command execution, reverse shell access, proxying, self-removal, and collection of logged-in user activity from standard Linux accounting sources.
A notable enhancement in later Linux versions is a companion filter component that replaces selected system binaries and suppresses output containing attacker-defined values, hiding malicious artifacts from common administrative utilities. This behavior gives the Linux branch rudimentary rootkit-like concealment capabilities in addition to persistence and full remote control.
DinodasRAT has been used for cyber espionage against governmental and regional targets and has been reported targeting Linux servers in multiple countries. Its development shows code reuse from publicly available remote administration projects, but its operational use, persistence mechanisms, encrypted communications, and concealment features make it a capable long-term access platform for state-aligned intrusion sets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This actor’s toolset notably includes a cross-platform backdoor named DinodasRAT, also known as XDealer... In this blog post, we share our full technical analysis of the latest Linux version (v11) of DinodasRAT, which we track as Linodas.
This actor’s toolset notably includes a cross-platform backdoor named DinodasRAT, also known as XDealer... In this blog post, we share our full technical analysis of the latest Linux version (v11) of DinodasRAT, which we track as Linodas.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
Earth Krahang that has targeted 116 entities spanning 35 countries by leveraging spear-phishing and flaws in public-facing Openfire and Oracle servers to deliver bespoke malware such as PlugX, ShadowPad, ReShell, and DinodasRAT.
0x18 Execute a process and send the response back Process path to execute | 0x1B Reverse shell start... 0x1C Reverse shell restart... 0x1D Reverse shell close... 0x1E Write to reverse shell
DinodasRAT uses APIs, e.g., CreateProcessW , to execute CMD commands on the victim’s machine.
The persistence process is quite extensive and covers multiple Ubuntu versions and RedHat distributions... achieves persistence by one of the following methods: Method 1 (Ubuntu) – rc.local enabled via systemd... Method 2 (Red Hat) – init.d script... Method 3 (Red Hat) – rc.local
The persistence process is quite extensive and covers multiple Ubuntu versions and RedHat distributions... achieves persistence by one of the following methods: Method 1 (Ubuntu) – rc.local enabled via systemd... Method 2 (Red Hat) – init.d script... Method 3 (Red Hat) – rc.local
Most of the samples we found have the name ntfsys, apparently attempting to masquerade as a system or driver file related to NTFS.
The extracted filenames are related to the phishing email subject lines: Guyanese fugitive in Vietnam20220101to20230214Guyanese fugitive in Vietnam.docx.exe
0x2E Self-fully uninstall, remove persistence, kill the parent daemon, and exit
If all three arguments were passed, DinodasRAT terminates the process represented by the process ID using the Windows API TerminateProcess then uses the Windows API DeleteFileW to delete the file passed in the third argument.
It then changes its file timestamp using the following command: touch -d \"2010-09-08 12:23:02\" [SELF_FILE_PATH]. This timestamp is also set to other backdoor-related files such as the config files when accessing them.
the latest version introduces a separate evasion module to hide any traces of malware in the system by proxying and modifying the system binaries’ execution... filter any values, such as IP, username, process name, or other artifacts, from various information-gathering binaries such as who, netstat, ps
Thread #1: Logged-in user monitor... monitors logged-in users using the who command... Thread #4: Logged-in users monitor and logging... its details are logged and sent to the C2 server... 0x0F Enumerate logged-in users
The mode field serves as the type of C2 communication to use, TCP or UDP... the malware sets up a socket in TCP or UDP mode, based on the configuration, and attempts to connect to the C2.
In order to communicate with the C&C server, DinodasRAT uses the Winsock library to create a socket that uses the TCP protocol. Although TCP is the default protocol used to send and receive information from the C&C server, we have seen that DinodasRAT is capable of changing to the UDP protocol.
0x08 Download a file from the C2 and execute it... Thread #3: Filter module download and setup... make another request to the C2 and save a newly received file
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cross-platform remote access trojan/backdoor used in cyber espionage. The Linux branch (Linodas) targets Linux servers, establishes persistence across Ubuntu and Red Hat systems, communicates with C2 over TCP or UDP, supports file operations, process and service control, reverse shell access, user/activity collection, and can deploy a filter module to hide artifacts by proxying and modifying system binary output.
A remote access trojan used by Earth Krahang in cyber espionage campaigns.
Remote access trojan targeting Linux servers, used for espionage, with persistence and encrypted C2 communication.
A previously undocumented C++ remote access trojan/backdoor used in Operation Jacana for cyberespionage. It can exfiltrate files, capture screenshots, collect clipboard data, manipulate registry keys, enumerate processes and services, execute commands including an interactive reverse shell, and communicate with its C2 over TCP or UDP using TEA encryption and some base64 encoding.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.