Resubmissions

26-03-2024 12:32

240326-pqvngsab98 1

26-03-2024 12:31

240326-pp6dladb4s 7

26-03-2024 12:26

240326-pmpcasda5z 7

General

  • Target

    https://github.com/MalwareSamples/Linux-Malware-Samples

  • Sample

    240326-pmpcasda5z

Malware Config

Targets

    • Target

      https://github.com/MalwareSamples/Linux-Malware-Samples

    • Changes its process name

    • Reads user data of web browsers

      Reads stored browser data which can include saved credentials.

    • Checks CPU configuration

      Checks CPU information which indicate if the system is a virtual machine.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Legitimate hosting services abused for malware hosting/C2

    • Reads CPU attributes

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Discovery

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Command and Control

Web Service

1
T1102

Tasks