Overview

overview

10

Static

static

10

50aaeda216...e5241f

linux_armhf

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    50aaeda216f7f405618eff9830e5241f
  • Size 731KB
  • Sample211219-w67fjsghc6
  • SHA256 a0d45da423f48b84b516c360a3ee501c793340a15fb2ca27c5d5e51a6c2da50c
  • MD5 SHA1 SHA512
Score
10/10
antivmbotnetlinuxpersistence

Malware Config

Targets

    • Target
      50aaeda216f7f405618eff9830e5241f
    • Size 731KB
    • SHA256 a0d45da423f48b84b516c360a3ee501c793340a15fb2ca27c5d5e51a6c2da50c
    • MD5 SHA1 SHA512
    Score
    9/10
    antivmpersistence

    • Attempts to identify hypervisor via CPU configuration

      Checks CPU information for indicators that the system is a virtual machine.

      antivm

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Modifies rc script

      Adding/modifying system rc scripts is a common persistence mechanism.

      persistence

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks