Overview

overview

9

Static

static

10

Linux.Encryptor

linux_amd64

9

Linux.Encryptor

linux_mipsel

Linux.Encryptor

linux_mips

Resubmissions

01-12-2021 14:24

211201-rqrmyafhe5 10

02-08-2021 18:37

210802-xqe2pesr3s 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Linux.Encryptor

  • Size

    2.0MB

  • Sample

    210802-xqe2pesr3s

  • MD5

    3f9a28e8c057e7ea7ccf15a4db81f362

  • SHA1

    10d6d3c957facf06098771bf409b9593eea58c75

  • SHA256

    6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502

  • SHA512

    58a71aeac247d206f023ee29aff81026881e41d3fbd268f7513e3bcd951701a68502361dd717befa79a094eb9fc0caaa9f8770ba83f5c94a8acb9ae0986ee386

Score
10/10
blackmatterbab21ee475b52c0c9eb47d23ec9ba1d1linuxpersistence

Malware Config

Extracted

Family

blackmatter

Version

1.6.0.2

Botnet

bab21ee475b52c0c9eb47d23ec9ba1d1

C2

http://paymenthacks.com

http://mojobiden.com
rsa_pubkey.plain
aes.plain

Targets

    • Target

      Linux.Encryptor

    • Size

      2.0MB

    • MD5

      3f9a28e8c057e7ea7ccf15a4db81f362

    • SHA1

      10d6d3c957facf06098771bf409b9593eea58c75

    • SHA256

      6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502

    • SHA512

      58a71aeac247d206f023ee29aff81026881e41d3fbd268f7513e3bcd951701a68502361dd717befa79a094eb9fc0caaa9f8770ba83f5c94a8acb9ae0986ee386

    Score
    9/10
    persistence

    • Deletes system logs

    • Modifies hosts file

      Adds to hosts file used for mapping hosts to IP addresses.

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence

    • Reads CPU attributes

    • Writes file to tmp directory

      Malware often drops required files in the /tmp directory.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Indicator Removal on Host

1
T1070

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Dynamic Resolution

1
T1568

Impact

Tasks