Overview

overview

10

Static

static

Linux_amd64

linux_amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Linux_amd64

  • Size

    2.3MB

  • Sample

    220503-b5tg3sfca5

  • MD5

    1a5edcf40f9d95c0c8fddc501ebd9f8c

  • SHA1

    8d4869df5df1a9a88e0d0a9d838c71f5e7aba939

  • SHA256

    a8875c3bad30270efe07611b8f68546d6cb6ab19f0105319ebaba0d624bab0bf

  • SHA512

    2da4c2507773713b755a1cc71f7d003afd51510611744fb52d1a6c63f603638616a8a8500d0049a36903c6a5ee4fb692398cd35ad03716aa61dfd06bd327d587

Score
10/10
stealthworkerantivmbotnetlinuxsuricata

Malware Config

Targets

    • Target

      Linux_amd64

    • Size

      2.3MB

    • MD5

      1a5edcf40f9d95c0c8fddc501ebd9f8c

    • SHA1

      8d4869df5df1a9a88e0d0a9d838c71f5e7aba939

    • SHA256

      a8875c3bad30270efe07611b8f68546d6cb6ab19f0105319ebaba0d624bab0bf

    • SHA512

      2da4c2507773713b755a1cc71f7d003afd51510611744fb52d1a6c63f603638616a8a8500d0049a36903c6a5ee4fb692398cd35ad03716aa61dfd06bd327d587

    Score
    10/10
    stealthworkerantivmbotnetsuricata

    • StealthWorker

      StealthWorker is golang-based brute force malware.

      botnetstealthworker

    • suricata: ET MALWARE GoBrut/StealthWorker Service Bruter CnC Activity

      suricata: ET MALWARE GoBrut/StealthWorker Service Bruter CnC Activity

      suricata

    • suricata: ET MALWARE GoBrut/StealthWorker Service Bruter CnC Checkin

      suricata: ET MALWARE GoBrut/StealthWorker Service Bruter CnC Checkin

      suricata

    • Attempts to identify hypervisor via CPU configuration

      Checks CPU information for indicators that the system is a virtual machine.

      antivm

    • Modifies hosts file

      Adds to hosts file used for mapping hosts to IP addresses.

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    • Writes file to tmp directory

      Malware often drops required files in the /tmp directory.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Dynamic Resolution

1
T1568

Impact

Tasks