A new malware targeting e-commerce servers has been discovered by the Sansec Threat Research Team. The threat actors appear to be probing e-commerce sites running Linux for multiple vulnerabilities. Once an exploit is found, such as a file upload vulnerability, the attacker uploads a webshell which gives full control over the website, then modified the server’s code to inject a credit card skimmer. Uniquely, the attacker also uploads a Linux executable file named “linux_avp” that acts like a backdoor for the attacker. Written in Golang, when it starts it removes itself from the disk to prevent detection then disguises it’s process as a fake “ps -ef”command. It then waits for a command from a server hosted on the Alibaba network in Beijing. To ensure persistence it adds a crontab entry which runs the malware from a remote server in case it is deleted or the process is terminated. The researchers found an IP address hosted in Hong Kong that was previously used as an exfiltration server for a skimming operation in July and August of this year. Interestingly, an individual submitted a version of this malware to the popular virus scanning site VirusTotal with the comment “test.” Despite this, the malware remains undetected in most anti-viruses. CTAPT analysts are monitoring this malware for future developments and will update if any new information is released.