--- title: This "Monero Exchange" is a Linux RAT | daily.dev description: A Linux-only Remote Access Trojan (RAT) disguised as a peer-to-peer Monero exchange app (AppImage) is analyzed in detail. The malware impersonates the... canonical: https://daily.dev/posts/this-monero-exchange-is-a-linux-rat-gtchyvocn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: This "Monero Exchange" is a Linux RAT | daily.dev og:description: A Linux-only Remote Access Trojan (RAT) disguised as a peer-to-peer Monero exchange app (AppImage) is analyzed in detail. The malware impersonates the... og:url: https://daily.dev/posts/this-monero-exchange-is-a-linux-rat-gtchyvocn og:image: https://api.daily.dev/og/posts/GTcHYvOcn.png og:image:alt: This "Monero Exchange" is a Linux RAT og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # This "Monero Exchange" is a Linux RAT **[Eric Parker](https://daily.dev/sources/ericparker)** · 19 min read · 0 upvotes · 0 comments ## Summary A Linux-only Remote Access Trojan (RAT) disguised as a peer-to-peer Monero exchange app (AppImage) is analyzed in detail. The malware impersonates the legitimate 'HaveNo' Monero project, targeting Linux users who want to acquire Monero anonymously. Once executed, it establishes persistence via a systemd service (ibushl.service), sets up a hidden X11/TigerVNC session for remote desktop access, steals documents, SSH keys, browser data, crypto wallets, KeePass databases, and exfiltrates everything to a C2 server. The analysis uses Docker sandboxes and AI coding agents (Codex) for safe static and dynamic analysis, with sandbox evasion techniques noted. The video concludes with a warning that Linux malware is a growing trend as Linux market share rises, and urges users not to assume Linux provides immunity from malware. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [A miner with a side of RAT: the unintended gift with your TV show or book](https://daily.dev/posts/a-miner-with-a-side-of-rat-the-unintended-gift-with-your-tv-show-or-book-zxmlmohf3) · Securelist · 0 upvotes · 0 comments - [The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT](https://daily.dev/posts/the-crypto-wallet-that-never-opened-tampered-exodus-installer-hides-a-modular-rat-az9eaqjiz) · Huntress Blog · 0 upvotes · 0 comments - [Russian hackers trojanize WebEx, Zoom apps to push Starland malware](https://daily.dev/posts/russian-hackers-trojanize-webex-zoom-apps-to-push-starland-malware-kv7oahrsr) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#docker](https://daily.dev/tags/docker), [#crypto](https://daily.dev/tags/crypto), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/this-monero-exchange-is-a-linux-rat-gtchyvocn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"This \"Monero Exchange\" is a Linux RAT","url":"https://daily.dev/posts/this-monero-exchange-is-a-linux-rat-gtchyvocn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/this-monero-exchange-is-a-linux-rat-gtchyvocn"},"datePublished":"2026-07-11T15:02:20.975Z","dateModified":"2026-07-11T15:02:42.541Z","description":"A Linux-only Remote Access Trojan (RAT) disguised as a peer-to-peer Monero exchange app (AppImage) is analyzed in detail. The malware impersonates the...","image":"https://i.ytimg.com/vi/m-frPZtSBwA/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/m-frPZtSBwA/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Eric Parker","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Eric Parker","logo":"https://media.daily.dev/image/upload/s--vVcOpkjx--/f_auto/v1724391603/logos/ericparker","url":"https://daily.dev/sources/ericparker"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/this-monero-exchange-is-a-linux-rat-gtchyvocn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux,docker,crypto,malware","timeRequired":"PT19M","video":{"@type":"VideoObject","name":"This \"Monero Exchange\" is a Linux RAT","description":"A Linux-only Remote Access Trojan (RAT) disguised as a peer-to-peer Monero exchange app (AppImage) is analyzed in detail. The malware impersonates the...","thumbnailUrl":"https://i.ytimg.com/vi/m-frPZtSBwA/sddefault.jpg","uploadDate":"2026-07-11T15:02:20.975Z","duration":"PT19M","url":"https://api.daily.dev/r/GTcHYvOcn","embedUrl":"https://www.youtube.com/embed/m-frPZtSBwA"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Eric Parker","item":"https://daily.dev/sources/ericparker"},{"@type":"ListItem","position":3,"name":"This \"Monero Exchange\" is a Linux RAT"}]} ```