General
-
Target
dfb3b9e8f06911fafd67cd01a02d19e7.bin
-
Size
44KB
-
Sample
240507-cdxwvsgc88
-
MD5
0bd068692f559133645cdf11a2c8e663
-
SHA1
1040c1da465feee478f2f76fd33972e7bf4e83ef
-
SHA256
24a800548a9cc548fc166fd15ca51ef239cce2724308587239ca62e9e097eb6f
-
SHA512
1aa54a19279b68434d4bfbf7d0939b5f7a7b5395ddfb7c2ac58047d311a2972df5d2889bcb11faa465727cf4844a9e8722277a3a003e7c74d9bddcda17a629f4
-
SSDEEP
768:riVy4Y4WLs7x0sVnFFrMq3viT88HjFbIdEM4FFZENLKgE769haF/FFexOokz08Mx:WVy4fWI9VbFwUvkN5bIdb46of767IFEx
Static task
static1
Behavioral task
behavioral1
Sample
ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf
Resource
ubuntu1804-amd64-20240226-en
Malware Config
Targets
-
-
Target
ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf
-
Size
103KB
-
MD5
dfb3b9e8f06911fafd67cd01a02d19e7
-
SHA1
6d2b48acc8cc55a612167c1ac60925f43a550f66
-
SHA256
ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270
-
SHA512
dd1271935dd1bbe240a296013d86162f9e81b6a1a62ee180913f47048956e9da121ef4a995cdd7834ba17f49399b905c212d218a2649ba40723e6da2fec5171b
-
SSDEEP
3072:aXaoPUZSK1mVKpn7q6WFjcArKRy3OFP9mRJf:Ca/ZdrqjcAilFPUb
Score7/10-
Modifies PAM framework files
Modifies Linux PAM framework files, possibly to intercept credentials.
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Modifies sudoers policy
Adds/ Modifies rule files for sudoers policy, likely to grant additional privileges.
-
Modifies user home skeleton directory
Modifies skeleton of initial home directory of newly added system users.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Deletes log files
Deletes log files on the system.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Write file to user bin folder
-
Writes file to system bin folder
-
Modifies Bash startup script
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Hijack Execution Flow
3Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
3Hijack Execution Flow
3Scheduled Task/Job
1