Overview

overview

10

Static

static

10

24b5cdfc8d...633073

linux_armhf

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    24b5cdfc8de10c99929b230f0dcbf7fcefe9de448eeb6c75675cfe6c44633073

  • Size

    4.6MB

  • Sample

    220617-h2mnpaddf2

  • MD5

    6ffabd3e67705be52bff0d21ce13caf0

  • SHA1

    a484ed721ff2b6bf651c8d057408e6af7a85d709

  • SHA256

    24b5cdfc8de10c99929b230f0dcbf7fcefe9de448eeb6c75675cfe6c44633073

  • SHA512

    d18ce8518e43e79a8b8809cbf842e7f7658fe3e83a15e8e3bb4dc2eec892b0cdff8b83bd7ce82eae8619e9e075d076283d0d6f3e5e69e270e43bd09856011dbe

Score
10/10
ech0raixlinuxpersistencesuricata

Malware Config

Targets

    • Target

      24b5cdfc8de10c99929b230f0dcbf7fcefe9de448eeb6c75675cfe6c44633073

    • Size

      4.6MB

    • MD5

      6ffabd3e67705be52bff0d21ce13caf0

    • SHA1

      a484ed721ff2b6bf651c8d057408e6af7a85d709

    • SHA256

      24b5cdfc8de10c99929b230f0dcbf7fcefe9de448eeb6c75675cfe6c44633073

    • SHA512

      d18ce8518e43e79a8b8809cbf842e7f7658fe3e83a15e8e3bb4dc2eec892b0cdff8b83bd7ce82eae8619e9e075d076283d0d6f3e5e69e270e43bd09856011dbe

    Score
    10/10
    persistencesuricata

    • suricata: ET MALWARE ZHtrap CnC Checkin

      suricata: ET MALWARE ZHtrap CnC Checkin

      suricata

    • suricata: ET MALWARE ZHtrap CnC Response - Connection Successfully Established

      suricata: ET MALWARE ZHtrap CnC Response - Connection Successfully Established

      suricata

    • Writes file to system bin folder

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Write file to user bin folder

    • Reads CPU attributes

    • Enumerates kernel/hardware configuration

      Reads contents of /sys virtual filesystem to enumerate system information.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    • Writes file to tmp directory

      Malware often drops required files in the /tmp directory.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks