General

  • Target

    dfb3b9e8f06911fafd67cd01a02d19e7.elf

  • Size

    103KB

  • Sample

    240505-cg91laed77

  • MD5

    dfb3b9e8f06911fafd67cd01a02d19e7

  • SHA1

    6d2b48acc8cc55a612167c1ac60925f43a550f66

  • SHA256

    ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270

  • SHA512

    dd1271935dd1bbe240a296013d86162f9e81b6a1a62ee180913f47048956e9da121ef4a995cdd7834ba17f49399b905c212d218a2649ba40723e6da2fec5171b

  • SSDEEP

    3072:aXaoPUZSK1mVKpn7q6WFjcArKRy3OFP9mRJf:Ca/ZdrqjcAilFPUb

Malware Config

Targets

    • Target

      dfb3b9e8f06911fafd67cd01a02d19e7.elf

    • Size

      103KB

    • MD5

      dfb3b9e8f06911fafd67cd01a02d19e7

    • SHA1

      6d2b48acc8cc55a612167c1ac60925f43a550f66

    • SHA256

      ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270

    • SHA512

      dd1271935dd1bbe240a296013d86162f9e81b6a1a62ee180913f47048956e9da121ef4a995cdd7834ba17f49399b905c212d218a2649ba40723e6da2fec5171b

    • SSDEEP

      3072:aXaoPUZSK1mVKpn7q6WFjcArKRy3OFP9mRJf:Ca/ZdrqjcAilFPUb

    Score
    7/10
    • Deletes journal logs

      Deletes systemd journal logs. Likely to evade detection.

    • Modifies PAM framework files

      Modifies Linux PAM framework files, possibly to intercept credentials.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Modifies sudoers policy

      Adds/ Modifies rule files for sudoers policy, likely to grant additional privileges.

    • Modifies user home skeleton directory

      Modifies skeleton of initial home directory of newly added system users.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Creates/modifies environment variables

      Creating/modifying environment variables is a common persistence mechanism.

    • Deletes log files

      Deletes log files on the system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

    • Modifies rc script

      Adding/modifying system rc scripts is a common persistence mechanism.

    • Write file to user bin folder

    • Writes file to system bin folder

    • Modifies Bash startup script

MITRE ATT&CK Enterprise v15

Tasks