Overview

overview

10

Static

static

10

0abc01de89...d4c10e

linux_armhf

10

Resubmissions

14/03/2022, 13:31

220314-qsqyrahgfn

14/03/2022, 13:27

220314-qp8dmafgh610

14/03/2022, 05:56

220314-gm2nmaffbr10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0abc01de8962867957bca89f6bd4c10e
  • Size 1.6MB
  • Sample220314-gm2nmaffbr
  • SHA256 46389c117c5f41b60e10f965b3674b3b77189b504b0aeb5c2da67adf55a7129f
  • MD5 SHA1 SHA512
Score
10/10
kaitenlinuxpersistencesuricata

Malware Config

Targets

    • Target
      0abc01de8962867957bca89f6bd4c10e
    • Size 1.6MB
    • SHA256 46389c117c5f41b60e10f965b3674b3b77189b504b0aeb5c2da67adf55a7129f
    • MD5 SHA1 SHA512
    Score
    10/10
    persistencesuricata

    • suricata: ET MALWARE ELF/Muhstik Botnet CnC Activity

      suricata: ET MALWARE ELF/Muhstik Botnet CnC Activity

      suricata

    • Writes file to system bin folder

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Modifies rc script

      Adding/modifying system rc scripts is a common persistence mechanism.

      persistence

    • Write file to user bin folder

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    • Writes file to tmp directory

      Malware often drops required files in the /tmp directory.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks