# Analysis of Malware Distributed Through Matrix Rooms to Mobile Linux Users

DevFeed: [Analysis of Malware Distributed Through Matrix Rooms to Mobile Linux Users](<https://devfeed.tech/articles/script-kiddy-strikes-back-34225.md>)

Original publisher: [Read original article](<https://blog.mobian.org/posts/2022/02/11/pinephone-malware-analysis/>)

Author: Mobian team

Published: 2022-02-11T00:00:00Z

Content type: article

Language: en

Sources: [Mobian's Blog](<https://devfeed.tech/sources/mobian-s-blog.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [Mobile](<https://devfeed.tech/topics/mobile.md>), [Security](<https://devfeed.tech/topics/security.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Matrix](<https://devfeed.tech/topics/matrix-org.md>), [apt](<https://devfeed.tech/topics/apt.md>)

Tags: [apt](<https://devfeed.tech/tags/apt.md>), [malware](<https://devfeed.tech/tags/malware.md>), [matrix](<https://devfeed.tech/tags/matrix.md>), [mobile](<https://devfeed.tech/tags/mobile.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

This article analyzes malware distributed through Matrix rooms as installable packages for postmarketOS, Mobian, and Arch/Manjaro. It examines the Debian package variant, its metadata and post-install script, and explains how execution with root privileges enables the malware to copy files and run its payload.

## Source excerpt

As you may be aware, a malicious person tried to spread malware through many Matrix rooms used by mobile Linux users and developers, partly taking advantage of a known vulnerability in the stock modem firmware. Here's a quick analysis of how this malware was supposed to operate. Disclaimer: while being enthusiastic nerds, none of the Mobian developers is a security expert. We hope this post will provide interesting information to the community but it shouldn't be considered an exhaustive security report. Please also note this was by no means a Mobian-only effort: in this post, we're reporting the findings of the mobile Linux community as a whole, not claiming we did it all by ourselves. A bit of context The malware was uploaded to Matrix chat rooms in the form of an installable binary package: .apk for postmarketOS .deb for Mobian .pkg.tar.zst for Arch/Manjaro Multiple variants were posted such as coathanger or pp-tweaks but, a few cosmetic differences aside, they all work in the same way and embed the same malicious payload. In the rest of this post, we'll take a closer look at the .deb package (obviously) of the pp-tweaks variant. This file is an actual package suitable for installation using dpkg or apt. Its package metadata look valid and contain the following description: Description: Tweaks for PinePhone and PinePhone Pro as well as various other devices such as the Oneplus 6 and the Poco F1 Although it's obvious that the package has been handcrafted rather than generated using the usual Debian packaging tools (no checksums included in the package metadata, for example), and except for the contents of the Maintainer field (layla289, maybe an Eric Clapton fan?), the package doesn't look harmful at this point. The following files are installed from this package: /usr/bin/pp-tweaks-gtk /usr/lib/pp-tweaks-postinstall It also contains the following post-install script, automatically run by dpkg once the package files have been installed to the system: #!/bin/sh /us