MYRA RAT LD_PRELOAD Persistence: libcache.so Drop + /etc/ld.so.preload Correlation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the creation of a potentially malicious shared library (libcache.so) in /usr/local/lib followed by a modification of the /etc/ld.so.preload file on Linux systems within a short time frame. This technique is commonly used for persistence and code injection, where the dynamic linker is forced to load the malicious library before others.