General

  • Target

    dfb3b9e8f06911fafd67cd01a02d19e7.bin

  • Size

    44KB

  • Sample

    240507-cdxwvsgc88

  • MD5

    0bd068692f559133645cdf11a2c8e663

  • SHA1

    1040c1da465feee478f2f76fd33972e7bf4e83ef

  • SHA256

    24a800548a9cc548fc166fd15ca51ef239cce2724308587239ca62e9e097eb6f

  • SHA512

    1aa54a19279b68434d4bfbf7d0939b5f7a7b5395ddfb7c2ac58047d311a2972df5d2889bcb11faa465727cf4844a9e8722277a3a003e7c74d9bddcda17a629f4

  • SSDEEP

    768:riVy4Y4WLs7x0sVnFFrMq3viT88HjFbIdEM4FFZENLKgE769haF/FFexOokz08Mx:WVy4fWI9VbFwUvkN5bIdb46of767IFEx

Malware Config

Targets

    • Target

      ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf

    • Size

      103KB

    • MD5

      dfb3b9e8f06911fafd67cd01a02d19e7

    • SHA1

      6d2b48acc8cc55a612167c1ac60925f43a550f66

    • SHA256

      ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270

    • SHA512

      dd1271935dd1bbe240a296013d86162f9e81b6a1a62ee180913f47048956e9da121ef4a995cdd7834ba17f49399b905c212d218a2649ba40723e6da2fec5171b

    • SSDEEP

      3072:aXaoPUZSK1mVKpn7q6WFjcArKRy3OFP9mRJf:Ca/ZdrqjcAilFPUb

    Score
    7/10
    • Deletes journal logs

      Deletes systemd journal logs. Likely to evade detection.

    • Modifies PAM framework files

      Modifies Linux PAM framework files, possibly to intercept credentials.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Modifies sudoers policy

      Adds/ Modifies rule files for sudoers policy, likely to grant additional privileges.

    • Modifies user home skeleton directory

      Modifies skeleton of initial home directory of newly added system users.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Creates/modifies environment variables

      Creating/modifying environment variables is a common persistence mechanism.

    • Deletes log files

      Deletes log files on the system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

    • Modifies rc script

      Adding/modifying system rc scripts is a common persistence mechanism.

    • Write file to user bin folder

    • Writes file to system bin folder

    • Modifies Bash startup script

MITRE ATT&CK Enterprise v15

Tasks