Overview

overview

10

Static

static

7

f4345a8c7f...7a.elf

debian-9-armhf

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4345a8c7f841767e5173140c8b57aedb4b9ad2333950341a37ffc2d1ed3f47a.elf

  • Size

    2.4MB

  • Sample

    240306-c6vl7sad77

  • MD5

    da12ead92069e02db3b88d15ac2c2823

  • SHA1

    297bf4ce9a344d6c27eba64bf1ddf2707567a2ef

  • SHA256

    f4345a8c7f841767e5173140c8b57aedb4b9ad2333950341a37ffc2d1ed3f47a

  • SHA512

    5769feee3276dbacae7a6711a7a5b7ddae425f689aa5655cb1bfb7dd4046a28ac075c807a8436a191542f97103c60ef42bcfd9110bb68a82891a2ab9b04cdd25

  • SSDEEP

    49152:e5R845g7EfVpclzm6XRkQfqFWWrO7dE2UlFHuOqrJPLWziHTHpDj:eDqUpuzmiRFiXrWa2UlwrJWzGFj

Score
10/10
stealthworkerantivmbotnetpersistenceupx

Malware Config

Targets

    • Target

      f4345a8c7f841767e5173140c8b57aedb4b9ad2333950341a37ffc2d1ed3f47a.elf

    • Size

      2.4MB

    • MD5

      da12ead92069e02db3b88d15ac2c2823

    • SHA1

      297bf4ce9a344d6c27eba64bf1ddf2707567a2ef

    • SHA256

      f4345a8c7f841767e5173140c8b57aedb4b9ad2333950341a37ffc2d1ed3f47a

    • SHA512

      5769feee3276dbacae7a6711a7a5b7ddae425f689aa5655cb1bfb7dd4046a28ac075c807a8436a191542f97103c60ef42bcfd9110bb68a82891a2ab9b04cdd25

    • SSDEEP

      49152:e5R845g7EfVpclzm6XRkQfqFWWrO7dE2UlFHuOqrJPLWziHTHpDj:eDqUpuzmiRFiXrWa2UlwrJWzGFj

    Score
    10/10
    stealthworkerantivmbotnetpersistence

    • StealthWorker

      StealthWorker is golang-based brute force malware.

      botnetstealthworker

    • Deletes itself

    • Checks CPU configuration

      Checks CPU information which indicate if the system is a virtual machine.

      antivm

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks