stealthworker | 71eed0656bcb2ca1f2f6af4cf073e14f17dadec7af9cd93153299c0fd4aa07c0 | Triage

Sharing

General

Target

afd986e0754c07002e764f8038a5fbf8
Size

8.2MB
Sample

240301-arelbsgf5z
MD5

afd986e0754c07002e764f8038a5fbf8
SHA1

bc18d23c16bbbadd6aa4ba226ff9cac0a9aafa20
SHA256

71eed0656bcb2ca1f2f6af4cf073e14f17dadec7af9cd93153299c0fd4aa07c0
SHA512

7ae76dd88f22ecc529d07606dba5cddd89f733980dccbed0e4dde83109775ea685d5bbc4813a5338666b12206a9ca6ffe66ff85024e76374c8c8b8c2625466ac
SSDEEP

49152:bK2IsqJ6+KCdOF87M6ee8ry770lDlzroschqayHQDx7XF/6jcRO8FYefPudx5zqn:vD+wFwz8raOVc76/6VfVf5rNOX

Score

10^/10

stealthworker antivm botnet discovery execution linux persistence privilege_escalatio

Malware Config

Targets

- Target
  
  afd986e0754c07002e764f8038a5fbf8
- Size
  
  8.2MB
- MD5
  
  afd986e0754c07002e764f8038a5fbf8
- SHA1
  
  bc18d23c16bbbadd6aa4ba226ff9cac0a9aafa20
- SHA256
  
  71eed0656bcb2ca1f2f6af4cf073e14f17dadec7af9cd93153299c0fd4aa07c0
- SHA512
  
  7ae76dd88f22ecc529d07606dba5cddd89f733980dccbed0e4dde83109775ea685d5bbc4813a5338666b12206a9ca6ffe66ff85024e76374c8c8b8c2625466ac
- SSDEEP
  
  49152:bK2IsqJ6+KCdOF87M6ee8ry770lDlzroschqayHQDx7XF/6jcRO8FYefPudx5zqn:vD+wFwz8raOVc76/6VfVf5rNOX
Score

6^/10

antivm discovery execution persistence privilege_escalatio
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalatio
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Cron

Persistence

Scheduled Task/Job

Cron

Privilege Escalation

Scheduled Task/Job

Cron

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Network Configuration Discovery

Virtualization/Sandbox Evasion

System Checks

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

botnetstealthworker

behavioral1

antivmdiscoveryexecutionpersistenceprivilege_escalatio