{"id":1312,"date":"2016-10-25T08:04:22","date_gmt":"2016-10-25T08:04:22","guid":{"rendered":"https:\/\/antivirus.comodo.com\/blog\/?p=1312"},"modified":"2025-04-07T19:32:02","modified_gmt":"2025-04-07T14:02:02","slug":"linux-trojan-self-deletes-elude-detection","status":"publish","type":"post","link":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/","title":{"rendered":"Sophisticated Linux Trojan Self-Deletes to Elude Detection"},"content":{"rendered":"<p>A new Linux trojan exploits weak security in Internet of Things (IoT) devices to infect those devices and allow them to be utilized as part of a Bot network. The trojan has been named ELF Linux\/NyaDrop. This trojan specifically targets the MIPS CPU architecture in Linux IoT devices.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3125\" src=\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2016\/10\/linux-trojan.jpg\" alt=\"linux trojan\" width=\"650\" height=\"300\" srcset=\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2016\/10\/linux-trojan.jpg 650w, https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2016\/10\/linux-trojan-300x138.jpg 300w, https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2016\/10\/linux-trojan-225x104.jpg 225w\" sizes=\"auto, (max-width: 650px) 100vw, 650px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>Recently security blogger Brian Krebs&#8217; website \u2013 krebsonsecurity.com \u2013 had faced a &#8220;historically large distributed denial-of-service (DDoS) attack&#8221;. The malware used for the attack has been named as &#8220;Mirai&#8221;. This <a href=\"https:\/\/valkyrie.comodo.com\/\" rel=\"noopener\" target=\"_blank\">malware scans<\/a> IoT devices connected to the internet to find out if they have the default authentication password. It has been seen as a trend that the default passwords are not being changed in many devices. This showcases the lack of importance given for changing the default passwords of devices. Many different types of IoT devices with 32bit clock MIPS CPU architecture were compromised &#8211; routers, digital video recorders, security cameras, and printers. (<a href=\"https:\/\/floridagreentree.com\/canadian-pharmacy\/\">Canada Pharmacy<\/a>) <\/p>\n<style>\n.uyiframe { text-align: center; margin: 20px 0; }\n.uyiframe iframe { width:560px !important; }\n<\/style>\n<div  class=\"uyiframe\">\n<iframe loading=\"lazy\" width=\"700\" height=\"315\" src=\"https:\/\/www.youtube.com\/embed\/WSHeyaQ5P60\" frameborder=\"0\" allow=\"autoplay; encrypted-media\" allowfullscreen><\/iframe>\n<\/div>\n<p>While the default password can be changed in most devices, there are some devices that have the passwords hardcoded into them. This is the scant regard for security that the device manufacturers had, or it could be intentional too&#8230; That is yet to be seen&#8230;<br \/>\nSome of these devices are very popular and used worldwide.<\/p>\n<p><strong>How the Attack Happens<\/strong><\/p>\n<p>The Linux\/NyaDrop exploits password vulnerability in IoT devices and infects them with malware. It is a brute force attack that penetrates the devices. The Linux\/NyaDrop is a Trojan backdoor and dropper. It opens a backdoor to remotely connect to a host that sends malicious files to the infected machine. This code is then executed and the device becomes part of the bot net.<\/p>\n<p>Every time the NyaDrop attempts and logs into the MIPS system it deletes itself. The malware also gets updated. This unique process prevents detection by most <a href=\"https:\/\/www.comodo.com\/home\/internet-security\/antivirus-for-linux.php\" target=\"_blank\">antivirus <\/a>solutions.<\/p>\n<p>The NyaDrop had got detected as early as in May 2016, however it was not as potent as it is now. An improved version of the NyaDrop was used in the Mirai botnet attack on the krebsonsecurity website, which showcased the awesome power it had. The public release of source code of the Mirai botnet revealed the Trojan NyaDrop.<\/p>\n<p><strong>Preventive Measures<\/strong><\/p>\n<ul>\n<li>Install a robust<a href=\"https:\/\/antivirus.comodo.com\/\" target=\"_blank\" rel=\"noopener\"> <strong>antivirus<\/strong><\/a> for Linux<\/li>\n<li>The antivirus must employ real-time cloud based scanning to analyze the processes and block malicious processes<\/li>\n<li>Hardware vendors must make it mandatory for users to change the default passwords<\/li>\n<li>A strong password policy must be specified for formation of passwords of IoT devices<\/li>\n<\/ul>\n<p><a href=\"https:\/\/antivirus.comodo.com\/download\/thank-you.php?prod=cloud-antivirus&#038;track=16678&#038;af=16678\" target=\"_blank\" rel=\"noopener\" onclick=\"ga('send', 'event', {eventCategory: 'Antivirus Blog', eventAction: 'Download', eventLabel: 'Bottom FREE DOWNLOAD banner Product AV'});ga('nT.send', 'event', {eventCategory: 'Antivirus Blog', eventAction: 'Download', eventLabel: 'Bottom FREE DOWNLOAD banner Product AV'});\"><img decoding=\"async\" class=\"aligncenter size-full wp-image-8604\" src=\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/04\/Comodo-Free-Antivirus.png\" alt=\"comodo antivirus\"\/><\/a><\/p>\n<p><a href=\"https:\/\/secure.nurd.com\/home\/purchase.php?pid=109&#038;af=16166\" target=\"_blank\" rel=\"noopener\" onclick=\"ga('send', 'event', {eventCategory: 'Antivirus Blog', eventAction: 'Click', eventLabel: 'GET COMPLETE PROTECTION banner Product CIS Pro'});ga('nT.send', 'event', {eventCategory: 'Antivirus Blog', eventAction: 'Click', eventLabel: 'GET COMPLETE PROTECTION banner Product CIS Pro'});\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-8604\" src=\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2020\/08\/complete-antivirus.png\" alt=\"comodo antivirus\" width=\"650\" height=\"83\" \/><\/a><\/p>\n<p><strong><strong>Related Resources:<\/strong><br \/>\n<\/strong><\/p>\n<p><strong><a href=\"https:\/\/www.comodo.com\/home\/internet-security\/antivirus-for-linux.php\" target=\"blank\" target=\"_blank\">https:\/\/www.comodo.com\/home\/internet-security\/antivirus-for-linux.php<\/a><\/strong><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A new Linux trojan exploits weak security in Internet of Things (IoT) devices to infect those devices and allow them to be utilized as part of a Bot network. The trojan has been named ELF Linux\/NyaDrop. This trojan specifically targets the MIPS CPU architecture in Linux IoT devices. &nbsp; Recently security blogger Brian Krebs&#8217; website [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":1500,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[75],"class_list":["post-1312","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-computer-safety","tag-antivirus-for-linux"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>A new linux malware named NyaDrop exploits IoT devices<\/title>\n<meta name=\"description\" content=\"The NyaDrop uses brute force attack that penetrates the devices and exploits password vulnerability in IoT devices and infects them with malware.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A new linux malware named NyaDrop exploits IoT devices\" \/>\n<meta property=\"og:description\" content=\"The NyaDrop uses brute force attack that penetrates the devices and exploits password vulnerability in IoT devices and infects them with malware.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/\" \/>\n<meta property=\"og:site_name\" content=\"Comodo Antivirus Blogs | Anti-Virus Software Updates\" \/>\n<meta property=\"article:published_time\" content=\"2016-10-25T08:04:22+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-04-07T14:02:02+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2016\/10\/RF-10296_thb_14.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"225\" \/>\n\t<meta property=\"og:image:height\" content=\"170\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"seo\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"seo\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/\",\"url\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/\",\"name\":\"A new linux malware named NyaDrop exploits IoT devices\",\"isPartOf\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2016\/10\/RF-10296_thb_14.jpg\",\"datePublished\":\"2016-10-25T08:04:22+00:00\",\"dateModified\":\"2025-04-07T14:02:02+00:00\",\"author\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/e534eccce9a7e6ced088443c73329462\"},\"description\":\"The NyaDrop uses brute force attack that penetrates the devices and exploits password vulnerability in IoT devices and infects them with malware.\",\"breadcrumb\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/#primaryimage\",\"url\":\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2016\/10\/RF-10296_thb_14.jpg\",\"contentUrl\":\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2016\/10\/RF-10296_thb_14.jpg\",\"width\":225,\"height\":170},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/antivirus.comodo.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Sophisticated Linux Trojan Self-Deletes to Elude Detection\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#website\",\"url\":\"https:\/\/antivirus.comodo.com\/blog\/\",\"name\":\"Comodo Antivirus Blogs | Anti-Virus Software Updates\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/antivirus.comodo.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/e534eccce9a7e6ced088443c73329462\",\"name\":\"seo\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3b7714e98dafc3a3b391832c0f5e2b406856b62c8e81ad94382c197cdb380790?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3b7714e98dafc3a3b391832c0f5e2b406856b62c8e81ad94382c197cdb380790?s=96&d=mm&r=g\",\"caption\":\"seo\"},\"url\":\"https:\/\/antivirus.comodo.com\/blog\/author\/seo\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"A new linux malware named NyaDrop exploits IoT devices","description":"The NyaDrop uses brute force attack that penetrates the devices and exploits password vulnerability in IoT devices and infects them with malware.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/","og_locale":"en_US","og_type":"article","og_title":"A new linux malware named NyaDrop exploits IoT devices","og_description":"The NyaDrop uses brute force attack that penetrates the devices and exploits password vulnerability in IoT devices and infects them with malware.","og_url":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/","og_site_name":"Comodo Antivirus Blogs | Anti-Virus Software Updates","article_published_time":"2016-10-25T08:04:22+00:00","article_modified_time":"2025-04-07T14:02:02+00:00","og_image":[{"width":225,"height":170,"url":"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2016\/10\/RF-10296_thb_14.jpg","type":"image\/jpeg"}],"author":"seo","twitter_card":"summary_large_image","twitter_misc":{"Written by":"seo","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/","url":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/","name":"A new linux malware named NyaDrop exploits IoT devices","isPartOf":{"@id":"https:\/\/antivirus.comodo.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/#primaryimage"},"image":{"@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/#primaryimage"},"thumbnailUrl":"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2016\/10\/RF-10296_thb_14.jpg","datePublished":"2016-10-25T08:04:22+00:00","dateModified":"2025-04-07T14:02:02+00:00","author":{"@id":"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/e534eccce9a7e6ced088443c73329462"},"description":"The NyaDrop uses brute force attack that penetrates the devices and exploits password vulnerability in IoT devices and infects them with malware.","breadcrumb":{"@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/#primaryimage","url":"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2016\/10\/RF-10296_thb_14.jpg","contentUrl":"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2016\/10\/RF-10296_thb_14.jpg","width":225,"height":170},{"@type":"BreadcrumbList","@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/linux-trojan-self-deletes-elude-detection\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/antivirus.comodo.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Sophisticated Linux Trojan Self-Deletes to Elude Detection"}]},{"@type":"WebSite","@id":"https:\/\/antivirus.comodo.com\/blog\/#website","url":"https:\/\/antivirus.comodo.com\/blog\/","name":"Comodo Antivirus Blogs | Anti-Virus Software Updates","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/antivirus.comodo.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/e534eccce9a7e6ced088443c73329462","name":"seo","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3b7714e98dafc3a3b391832c0f5e2b406856b62c8e81ad94382c197cdb380790?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3b7714e98dafc3a3b391832c0f5e2b406856b62c8e81ad94382c197cdb380790?s=96&d=mm&r=g","caption":"seo"},"url":"https:\/\/antivirus.comodo.com\/blog\/author\/seo\/"}]}},"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/posts\/1312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/comments?post=1312"}],"version-history":[{"count":28,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/posts\/1312\/revisions"}],"predecessor-version":[{"id":21291,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/posts\/1312\/revisions\/21291"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/media\/1500"}],"wp:attachment":[{"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/media?parent=1312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/categories?post=1312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/tags?post=1312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}