Quasar Linux Qlnx Fileless Rat Supply Chain Compromise

Quasar Linux (QLNX) — Inside a Fileless Linux RAT Built for Supply Chain Compromise

TechOwl TechOwl May 12, 2026
Quasar Linux (QLNX) — Inside a Fileless Linux RAT Built for Supply Chain Compromise
A 148-kilobyte ELF binary — smaller than most configuration files — gives an attacker fileless persistence, a dual-layer rootkit, PAM credential interception, and the keys to your entire software supply chain. It compiles its own rootkit on your machine using your own gcc. It hides from ps, ls, and netstat at both userspace and kernel level. It masquerades as a kernel thread. And at the time of discovery, only 4 out of 70 security solutions detected it. This is Quasar Linux.

Executive Summary

Our threat research analysis of Quasar Linux (QLNX) found a previously undocumented, full-featured Linux Remote Access Trojan. Despite sharing the "Quasar" name with the well-known open-source Windows RAT (C#/.NET), QLNX is an entirely separate native Linux implant purpose-built for one mission: compromising developer and DevOps workstations to enable software supply chain attacks.

  • Fileless execution — Copies itself into RAM via memfd_create, deletes the original binary, re-executes from memory. No on-disk footprint.
  • Dual-layer rootkit — Userland LD_PRELOAD hooks + kernel-level eBPF program. Hides processes, files, and network ports from standard tools.
  • PAM backdoor with master password — Intercepts authentication in plaintext. Hardcoded bypass: O$$f$QtYJK
  • Supply chain credential theft — Steals NPM tokens, PyPI upload keys, AWS credentials, Kubernetes configs, Docker auth, GitHub CLI tokens, SSH keys, Vault tokens, Terraform credentials, and .env files.
  • 58 C2 commands — Shell access, file management, process injection, keylogging, screenshots, SOCKS proxy, TCP tunneling, BOF/COFF execution, and P2P mesh networking.
  • 7 persistence methods — Systemd, crontab, init.d, XDG autostart, .bashrc injection, LD_PRELOAD, and PAM backdoor — deployed based on privilege level.
  • Compiles its own rootkit on-target — Embedded C source code compiled with the host's gcc. No pre-built binaries to signature-match.
  • 4/70 AV detection rate — Multiple vendors score it as "Legit File" or misclassify it entirely.

The Threat at a Glance

Field Detail
NameQuasar Linux (QLNX)
TypeFull-featured Linux RAT with rootkit, PAM backdoor, credential harvester
Binaryquasar-implant — ELF 64-bit x86_64, 148 KB
Version1.4.1
TargetDeveloper / DevOps workstations (supply chain pivot)
C2 ProtocolMagic: QLNX (0x514C4E58) — TCP/TLS, HTTPS, HTTP + P2P mesh
Commands58 registered handlers
Persistence7 methods (Types 0–6) — selected by privilege level
Detection4/70 AV engines at time of publication
AV SignatureHEUR:Backdoor.Linux.Quazar.a
DeliveryHTA dropper files (invoice/financial-themed phishing)
First SeenApril 2026 (static analysis); May 2026 (public reporting)
Why this is different from the Windows Quasar RAT: The original Quasar is a C#/.NET Windows RAT hosted on GitHub since 2014. QLNX shares only the name — it is a native Linux ELF binary with completely different architecture, protocol, and capabilities. There is no code overlap between the two.

Technical Architecture: Seven Functional Blocks

QLNX packs seven distinct functional modules into a single 148 KB dynamically-linked ELF binary. It links against libc, libssl, libpthread, and libdl — leveraging the host's own libraries to keep the binary small. The LD_PRELOAD rootkit and PAM backdoor are shipped as embedded C source code and compiled on-target using gcc.

# Block Description
1RAT Core58-command framework: shell, file/process management, system control, network ops. Custom TCP/TLS or HTTP/S C2.
2RootkitDual-layer: userland LD_PRELOAD hooks + kernel-level eBPF. Hides files, processes, network ports.
3Credential AccessSSH keys, browser data, cloud configs, /etc/shadow, PAM backdoors for plaintext auth interception.
4SurveillanceKeylogger, screenshots, clipboard monitoring.
5Lateral MovementTCP tunneling, SOCKS proxy, port scanning, SSH pivoting, P2P mesh.
6Execution EngineProcess injection (ptrace, /proc/pid/mem), in-memory BOF/COFF execution.
7Filesystem MonitoringReal-time inotify-based file change tracking.

Fileless Execution Chain

What this means in plain terms: QLNX runs entirely from RAM. After first execution, the original file is deleted from disk and the malware re-launches itself from an anonymous memory region. It then disguises its process name as a legitimate kernel thread. Standard forensic disk imaging will find nothing.
// QLNX fileless execution chain [1] CHECK readlink("/proc/self/exe") → check for "memfd:" or "(deleted)" Check _MFD_RE env var → re-execution guard (prevent infinite loop) [2] COPY TO RAM open /proc/self/exe → syscall(319) memfd_create → read 8KB chunks → write to memfd [3] ERASE + RE-EXECUTE fcntl(clear close-on-exec) → unlink(original binary) → setenv("_MFD_RE","1") syscall(322) execveat(memfd_fd) → fallback: execv("/proc/self/fd/<memfd>") [4] MASQUERADE prctl() → spoof process name → "kworker" or "ksoftirqd" Result: fileless, in-memory, disguised as kernel thread. Disk is clean.

Persistence Mechanisms: 7 Methods, Privilege-Aware

QLNX selects persistence methods dynamically based on privilege level and system capabilities. The C2 triggers persistence via command opcode 0x72 with parameters: name, path, and type ID. Multiple methods can be deployed simultaneously.

QLNX Persistence Decision Tree — C2 Command 0x72 C2 command: 0x72 name, path, type Privilege getuid() Root (UID 0) Any user Type 0 Systemd system /etc/systemd/system/ Type 4 init.d script /etc/init.d/ gcc? installed Yes Type 5 LD_PRELOAD rootkit Compile .so on target via gcc Type 1 .bashrc injection Append nohup line Type 2 Crontab @reboot entry Type 3 Systemd user ~/.config/systemd/user/ Desktop session? Yes Type 6 XDG Autostart ~/.config/autostart/ Root required Any user Conditional
Figure 1: QLNX persistence decision tree — root vs. user-level methods. Type 5 (LD_PRELOAD) requires gcc on target. Type 6 (XDG) requires desktop session.
Type Method Path Requires
0Systemd system service/etc/systemd/system/Root (UID 0)
1.bashrc injectionAppend nohup lineAny user
2Crontab@reboot entryAny user
3Systemd user service~/.config/systemd/user/Any user
4init.d script/etc/init.d/Root (UID 0)
5LD_PRELOAD rootkit/etc/ld.so.preloadRoot + gcc
6XDG Autostart~/.config/autostart/Desktop session

Dual-Layer Rootkit

Layer 1: Userland — LD_PRELOAD

The rootkit source code is stored as C string literals inside the binary. On deployment: source is written to /tmp/.pcs_XXXXXX via mkstemp, compiled with gcc to produce /usr/lib/.libpam_cache.so, and installed via /etc/ld.so.preload — loading into every dynamically linked process on the system. Hooked libc functions: readdir, open, stat, lstat, access.

Layer 2: Kernel — eBPF

QLNX eBPF Rootkit Architecture — Dual-layer Hiding Userland (implant) eBPF rootkit controller Receives C2 command Userland tracking arrays For action 8 status query PID: int32[64] n=3 File: char[64][256] n=3 Port: int32[32] n=2 syscall(321, 0, attr, 168) bpf(BPF_MAP_CREATE) syscall(321, 2, attr, 168) bpf(BPF_MAP_UPDATE_ELEM) syscall(321, 3, attr, 168) bpf(BPF_MAP_DELETE_ELEM) Returns fd Kernel space PID hash map Key: 4 bytes (PID) | Val: 1B | Max: 64 1842 : 0x01 3091 : 0x01 512 : 0x01 ... File hash map Key: 256 bytes (path) | Val: 1B | Max: 64 /tmp/.agent.so /opt/.config /var/log/.cache ... Port hash map Key: 2 bytes (port) | Val: 1B | Max: 32 4444 : 0x01 8080 : 0x01 ... FDs kept open for process lifetime — kernel preserves maps while referenced Averts slow BPF iteration eBPF program (not present in binary) Attaches to kernel hooks and reads maps to filter syscall results hooks into: getdents64 Process listing open / stat File access TCP iterators Network listing ps / top / htop ls / find / stat ss / netstat Standard forensic tools are blind to hidden PIDs, files, and ports
Figure 2: eBPF rootkit architecture — the controller manages three kernel-space BPF hash maps via syscall 321. The eBPF program (loaded at runtime, not in binary) hooks getdents64, open/stat, and TCP iterators.
BPF Map Key Max Hides from
PID map4 bytes (PID)64ps, top, htop
File map256 bytes (path)64ls, find, stat
Port map2 bytes (port)32ss, netstat

C2 Protocol and P2P Mesh

Every session begins with the 4-byte magic QLNX (0x514C4E58). The packet format uses a 6-byte header: 4-byte little-endian payload length + 2-byte command ID. Three channels are supported:

Channel Encryption Details
Raw TCPTLS (cert validation disabled)Default. 4-step handshake, persistent command loop.
HTTPSTLSPOST for Base64 data, GET polling every 5 seconds.
HTTPNonePlaintext fallback.

The initial beacon (Command ID 0x01) transmits: malware version (1.4.1), OS version, privilege level, geolocation (via ip-api.com), machine fingerprint (SHA256 of MAC or /etc/machine-id), username, hostname, and active IPv4 interfaces.

P2P Mesh: QLNX includes a peer-to-peer mesh capability that links infected hosts together, turning individual implants into a distributed network. Compromised systems function as relay points, maintaining communication even when portions of the C2 infrastructure are taken down. This makes complete eradication significantly more difficult.

Credential Harvesting and PAM Backdoors

Targeted Files

File Impact if Stolen
.npmrcPush trojanized packages to npm registry
.pypircUpload malicious Python packages
.git-credentialsCommit backdoors to repositories
.aws/credentialsFull cloud infrastructure access
.kube/configContainer orchestration takeover
.docker/config.jsonPush poisoned container images
.vault-tokenSecret management access
Terraform credentials, GitHub CLI tokens, SSH keys, .env files, Firefox profiles, /etc/shadowInfrastructure manipulation, lateral movement, session hijacking, password hash theft

PAM Backdoor #1 (Primary)

Embedded C source → /tmp/.pcs_XXXXXX → compiled to /usr/lib/.libpam_cache.so → installed via /etc/ld.so.preload. Intercepts PAM authentication, captures plaintext credentials. Contains master password bypass: O$$f$QtYJK. XOR-encrypts stolen credentials to /var/log/.ICE-unix (SSH) and /var/log/.Test-unix (SSH/SCP/SU/sudo).

PAM Backdoor #2 (Lightweight)

Loads into dynamically linked processes. Extracts service name, username, and authentication token. Stored in plaintext to /tmp/.pam_cache.

Supply Chain Attack Path

// QLNX supply chain kill chain [1] INITIAL ACCESS Phishing HTA droppers (invoice-themed) → QLNX implant delivered [2] ESTABLISH FOOTHOLD Fileless execution → 7 persistence methods → dual-layer rootkit → invisible [3] CREDENTIAL HARVEST .npmrc → .pypirc → .aws/credentials → .kube/config → .docker/config.json .vault-token → GitHub CLI → SSH keys → .env → PAM plaintext passwords [4] SUPPLY CHAIN PIVOT Push trojanized packages to NPM/PyPI → inject backdoors into containers Modify CI/CD pipelines → lateral move: developer laptop → production cloud One compromised developer = gateway to millions of downstream users
A major Python package supply chain compromise in March 2026 followed this exact pattern. Stolen credentials from a developer's workstation were used to trojanize a widely-used package with 3.4 million daily downloads. QLNX is purpose-built to repeat this at scale.

Indicators of Compromise

File Hashes

Type Hash
SHA256 (primary)ea1d34b21b739a6bbf89b3f7e67978005cf7f3eda612cefc7eac1c8ead7c5545
SHA1b0f2c668cbdd63a871c90592b6c93e931115872e
MD570f70743f287a837d17c56933152a8a6
SSDEEP3072:SQL8Wfof3Ji3d2t77bc+R4PJUxv6UumQgxzLwze+1Nro:BeJ82Nb/R4Cxv6UQ6aN0

Additional Related Hashes

417430b2d4ae8d005224a9ff5dcb4007d452338acbcbcbb62c4e8ed1a70552dd
42d0c420eb5fe181388f2e4f0b7d7c0d302971e7a06fdc1bec481b68c8ccae1f
82daa93219ba40a6e41cdf3174ba57eb5d3383d1cd805584e9954eb0200182a1
c99cf0dc1ef1057d713cb082acaf42e4df4656809c91741752bddcab39bbfaca
d55549d5655e2f202e215676f4bdb0994ea08a93d15ec4ded413f64cfa7facc8
ea89caab82181881d971be312412795051f6322b105c8b9d29cfb5729fab8d33

Network IOCs

Indicator Type Context
38.210.209.142IPv4C2 server (US, AS174)
http://38.210.209.142:8181/loginURLC2 operator panel
208.95.112.1 / ip-api.comIPv4Geolocation beacon (NOT C2)

Host-Based IOCs

Artifact Value
Lock file/tmp/.X752e2ca1-lock
PAM source temp/tmp/.pcs_XXXXXX
PAM compiled SO/usr/lib/.libpam_cache.so
Rootkit config/etc/ld.so.preload (modified)
Cred log (SSH)/var/log/.ICE-unix
Cred log (multi)/var/log/.Test-unix
PAM #2 log/tmp/.pam_cache
Env variable_MFD_RE=1
Process nameskworker, ksoftirqd
Protocol magicQLNX / 0x514C4E58
DJB2 hash0x752e2ca1
PAM master passwordO$$f$QtYJK

MITRE ATT&CK Mapping

Tactic ID QLNX Implementation
ExecutionT1059.004Unix shell, popen/system calls
PersistenceT1037.004RC scripts, systemd services, crontab
PersistenceT1574LD_PRELOAD hijack via /etc/ld.so.preload
Priv EscalationT1548.004sudo, pkexec
Defense EvasionT1564.010argv0 masquerade as kworker/ksoftirqd
Defense EvasionT1014LD_PRELOAD + eBPF dual-layer rootkit
Defense EvasionT1055.003ptrace-based thread injection
Credential AccessT1552.001.npmrc, .pypirc, .aws/credentials, .env
Credential AccessT1555PAM backdoor plaintext credential interception
Credential AccessT1003.008/etc/passwd and /etc/shadow dumping
CollectionT1115Clipboard monitoring
ExfiltrationT1041Encrypted TLS/HTTPS exfiltration over C2
Lateral MovementT1210SSH with harvested keys to remote hosts

Detection and Hunting Guidance

Quick Triage Script

#!/bin/bash
# QLNX Quick Triage — run as root
echo "=== QLNX Indicator Check ==="

echo "[*] Lock file..."
ls -la /tmp/.X752e2ca1-lock 2>/dev/null && echo " FOUND!" || echo " Clean"

echo "[*] ld.so.preload..."
cat /etc/ld.so.preload 2>/dev/null && echo " CHECK ABOVE" || echo " Clean"

echo "[*] PAM backdoor SO..."
ls -la /usr/lib/.libpam_cache.so 2>/dev/null && echo " FOUND!" || echo " Clean"

echo "[*] Credential logs..."
ls -la /var/log/.ICE-unix /var/log/.Test-unix /tmp/.pam_cache 2>/dev/null && echo " FOUND!" || echo " Clean"

echo "[*] Memfd processes..."
ls -la /proc/*/exe 2>/dev/null | grep -i memfd && echo " FOUND!" || echo " Clean"

echo "[*] eBPF maps..."
bpftool map list 2>/dev/null | head -20

echo "[*] _MFD_RE env variable..."
grep -rl "_MFD_RE" /proc/*/environ 2>/dev/null && echo " FOUND!" || echo " Clean"

echo "=== Done ==="

Remediation

Full remediation requires:
  1. Remove entries from /etc/ld.so.preload
  2. Delete /usr/lib/.libpam_cache.so
  3. Remove all persistence: systemd, crontab, init.d, .bashrc, XDG autostart
  4. Kill memfd-backed processes
  5. Unload eBPF programs: bpftool prog list and remove
  6. Rotate ALL credentials — npm tokens, PyPI keys, AWS creds, SSH keys, K8s configs, Docker auth, Vault tokens, GitHub tokens, .env secrets
  7. Audit package registries for unauthorized publishes
  8. Check CI/CD pipelines for injected steps
  9. Consider full reimaging — the dual-layer rootkit makes partial cleanup unreliable

Conclusion

QLNX is not a retooled Windows RAT or a noisy botnet agent. It is a purpose-built developer workstation implant designed from the ground up for supply chain compromise. The combination of fileless execution, dual-layer rootkit, PAM authentication interception, and targeted credential harvesting creates a threat that is both difficult to detect and devastating in impact.

The fact that it was detected by only 4 AV engines — and that some vendors score it as "Legit File" — tells us that traditional signature-based detection is insufficient. Defenders need behavioral monitoring: watch for memfd-backed processes, LD_PRELOAD modifications, unexpected eBPF programs, and gcc compiling shared objects from temp files.

QLNX doesn't need to compromise a build server or CI pipeline directly — it compromises the human whose credentials have access to those systems. One developer laptop becomes a gateway to every package registry, container repo, and cloud environment they touch.

Check your ld.so.preload. Run the triage script. Rotate credentials. The supply chain clock is ticking.

TechOwl SHIELD
Continuous Threat Intelligence & Attack Surface Monitoring

Vulnerability Assessment

Deep technical analysis of vulnerabilities affecting your infrastructure — beyond CVSS scores to real-world exploitability and impact.

Attack Surface Intelligence

Passive mapping of your external presence — every exposed service, endpoint, and piece of infrastructure visible to the public internet.

Threat Hunting

Proactive detection of compromise indicators, APT activity, and post-exploitation artifacts across your email and identity infrastructure.

Dark Web Monitoring

Continuous surveillance of stolen credential markets, threat actor forums, and data leak channels. Know when you're being targeted before it becomes an incident.

© 2026 TechOwl SHIELD. All rights reserved.

Related Posts