Overview

overview

9

Static

static

9e1ebff427...d6c350

linux_amd64

9e1ebff427...d6c350

linux_mipsel

9

9e1ebff427...d6c350

linux_mips

9e1ebff427...d6c350

linux_armhf

Sharing

Copy URL Twitter E-mail

General

  • Target
    9e1ebff427d91089e7459f3dbad6c350
  • Size 1.1MB
  • Sample211208-m5n35scfc9
  • SHA256 ac04dbc126c3961657280b82dcccc728d5ffd3486ab5c8b6401c4bea84a7315e
  • MD5 SHA1 SHA512
Score
9/10
antivmlinuxpersistence

Malware Config

Targets

    • Target
      9e1ebff427d91089e7459f3dbad6c350
    • Size 1.1MB
    • SHA256 ac04dbc126c3961657280b82dcccc728d5ffd3486ab5c8b6401c4bea84a7315e
    • MD5 SHA1 SHA512
    Score
    9/10
    antivmpersistence

    • Attempts to identify hypervisor via CPU configuration

      Checks CPU information for indicators that the system is a virtual machine.

      antivm

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Modifies rc script

      Adding/modifying system rc scripts is a common persistence mechanism.

      persistence

    • Reads CPU attributes

    • Reads system network configuration

      Uses contents of /proc filesystem to enumerate network settings.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v6

Tasks