GSocket Backdoor Delivered Through Bash Script, (Fri, Mar 20th)

This report analyzes a malicious Bash script that deploys a GSocket (gs-netcat) backdoor, establishing outbound relay-based C2 communications and implementing cross-Unix persistence and anti-forensic timestamp restoration techniques. The analyst documents the installation paths, cron/profile persistence, embedded helper functions used to track and restore file timestamps, and provides IOCs including file SHA256 hashes and related references.