Prompting the Payload: How an npm Supply Chain Attack Delivered the RedC2 AI-Powered Linux Implant 

----

SHA-256 								File name 		Detection					

4537B1189CE419F1A595CF47216C03F80E9170CE80DAD8D9227A1E52F9CB3466	math-core.bin		Backdoor.Linux.REDSHELL.A
									math-calc.bin
									calc-math.dat
									calc-cache.bin
									math-calc.bin
									calc.bin
									calc-mapping.bin
969EF45E5E1C382D421580B8306AFF0ABF0C4D302F0AF7091AC44CE70A92F789	index.mjs		Trojan.JS.REDSHELL.A
1C5B97AD2212DE1046EAB1EF66FF5E7E21CA93C918F54F3369C06C64271F2D82	index.mjs		Trojan.JS.REDSHELL.A
0B9AEF51D5EC55D69FB52ADA41377CED07C6CFF0CAD09174390F49081D439B14	index.mjs		Trojan.JS.REDSHELL.A
F71FFEC658EB31FB2292F83E02F9451ACB6A6D70F1B7988D9CCC308286B288B9	index.mjs		Trojan.JS.REDSHELL.A
69FE4881065CF4A5E30CBAEAF30C16FD891D5BFC5A6263E518FB3EF2E23D0889	index.mjs		Trojan.JS.REDSHELL.A
7FCC2BAA9D65C190A07ADD27F84AD0644AC77A62EEB5A49062BAD290133E2CD6	index.mjs		Trojan.JS.REDSHELL.A
5537E187A3A1C1CDBD598246079910232ADD2B0097D15FBA9AAF8004B92384C1	index.mjs		Trojan.JS.REDSHELL.A
9e8a5128cea298d21b8e3b24102d48cd3b256bb7f229e75c854ccfbe8ed4fb76	index.mjs		Trojan.JS.REDSHELL.A
e9a4d708f22170e7fe307593af7a5ae5feea06907ade075a3fd8a0c116ed707a	index.mjs		Trojan.JS.REDSHELL.A
3ca67aa27a7544cfbc8a6b8b73628d6217560cd5f6e13fb167985689ab7bbff0	index.mjs		Trojan.JS.REDSHELL.A
7a5221c06710393fc3893ef8b697bf8a2a24c63b3b8fde77433a9516127cba4d	index.mjs		Trojan.JS.REDSHELL.A
3ad446777c04146aa878643fd286094363a3ed74865a1644a39c76079d72960b	index.mjs		Trojan.JS.REDSHELL.A
24e51473f03947dcb8ea8898d93067bbd284850dde33ef983b568b113a632fa2	index.mjs		Trojan.JS.REDSHELL.A
c753b7cbd2ffb89ad51dc6f48714204df8955d000520174329dd3785aede4562  	index.mjs 		Trojan.JS.REDSHELL.A
----

File system IOCs

Path / Target 					Description 

~/.config/.rsvc 				Configuration file used to store the bot's session ID (falls back to `/tmp/.config/.rsvc` if HOME is not set). 
~/.config/systemd/user/svc-update.service 	Systemd service file created for persistence. 
~/.config/autostart/system-updater.desktop 	XDG desktop entry file created for autostart persistence. 
/tmp/.sc_XXXXXX 				Temporary file pattern used for downloading and executing shellcode. mktemp replaces the six X characters with a unique random 								string. Example resulting paths: /tmp/.sc_7xMb1Z 
/tmp/.elf_XXXXXX 				Temporary file pattern used for downloading and executing ELF binaries. 
/tmp/.dl_XXXXXX.tar.gz 				Temporary archive pattern used for directory exfiltration via the /download command. 
/tmp/.ft_XXXXXX.tar.gz 				Temporary archive pattern used for directory exfiltration via the /fetch command. 
/tmp/.st_XXXXXX 				Temporary file pattern used for staging payloads via the /stage command. 
/tmp/.sk_XXXXXX 				Temporary directory pattern used to stage stolen SSH keys before exfiltration. 
/tmp/.cr_XXXXXX 				Temporary directory pattern used to stage stolen browser credentials before exfiltration.