General
-
Target
dfb3b9e8f06911fafd67cd01a02d19e7.elf
-
Size
103KB
-
Sample
240505-cg91laed77
-
MD5
dfb3b9e8f06911fafd67cd01a02d19e7
-
SHA1
6d2b48acc8cc55a612167c1ac60925f43a550f66
-
SHA256
ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270
-
SHA512
dd1271935dd1bbe240a296013d86162f9e81b6a1a62ee180913f47048956e9da121ef4a995cdd7834ba17f49399b905c212d218a2649ba40723e6da2fec5171b
-
SSDEEP
3072:aXaoPUZSK1mVKpn7q6WFjcArKRy3OFP9mRJf:Ca/ZdrqjcAilFPUb
Static task
static1
Behavioral task
behavioral1
Sample
dfb3b9e8f06911fafd67cd01a02d19e7.elf
Resource
ubuntu2004-amd64-20240221-en
Malware Config
Targets
-
-
Target
dfb3b9e8f06911fafd67cd01a02d19e7.elf
-
Size
103KB
-
MD5
dfb3b9e8f06911fafd67cd01a02d19e7
-
SHA1
6d2b48acc8cc55a612167c1ac60925f43a550f66
-
SHA256
ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270
-
SHA512
dd1271935dd1bbe240a296013d86162f9e81b6a1a62ee180913f47048956e9da121ef4a995cdd7834ba17f49399b905c212d218a2649ba40723e6da2fec5171b
-
SSDEEP
3072:aXaoPUZSK1mVKpn7q6WFjcArKRy3OFP9mRJf:Ca/ZdrqjcAilFPUb
Score7/10-
Modifies PAM framework files
Modifies Linux PAM framework files, possibly to intercept credentials.
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Modifies sudoers policy
Adds/ Modifies rule files for sudoers policy, likely to grant additional privileges.
-
Modifies user home skeleton directory
Modifies skeleton of initial home directory of newly added system users.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Deletes log files
Deletes log files on the system.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Write file to user bin folder
-
Writes file to system bin folder
-
Modifies Bash startup script
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Hijack Execution Flow
3Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
3Hijack Execution Flow
3Scheduled Task/Job
1