General

  • Target

    02e8db57e0594147ce3b00eb9237fba7725a7592a1bac7e44466c2b3d1c70da1.elf

  • Size

    101KB

  • Sample

    241128-cg5qwazqdw

  • MD5

    bdf14a42cff732e6534386ac4e18dfac

  • SHA1

    e229c2112a239c32d22ab9493bc00d20fb84edf4

  • SHA256

    02e8db57e0594147ce3b00eb9237fba7725a7592a1bac7e44466c2b3d1c70da1

  • SHA512

    ad1b9ac5cb1810de6d8c5c45dfbcad6b51e2837fa6e6dab2d48f3873b6ffdc3ab081597741d5a96b34309b31586bb48e88348a3b39f58869b973855bd4fdc042

  • SSDEEP

    3072:zlo+XtQr3vKGcQZ0ImNx1crsgm6BJcJjP07Sf:5o+XtQXmDTtjsuf

Malware Config

Targets

    • Target

      02e8db57e0594147ce3b00eb9237fba7725a7592a1bac7e44466c2b3d1c70da1.elf

    • Size

      101KB

    • MD5

      bdf14a42cff732e6534386ac4e18dfac

    • SHA1

      e229c2112a239c32d22ab9493bc00d20fb84edf4

    • SHA256

      02e8db57e0594147ce3b00eb9237fba7725a7592a1bac7e44466c2b3d1c70da1

    • SHA512

      ad1b9ac5cb1810de6d8c5c45dfbcad6b51e2837fa6e6dab2d48f3873b6ffdc3ab081597741d5a96b34309b31586bb48e88348a3b39f58869b973855bd4fdc042

    • SSDEEP

      3072:zlo+XtQr3vKGcQZ0ImNx1crsgm6BJcJjP07Sf:5o+XtQXmDTtjsuf

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Checks mountinfo of local process

      Checks mountinfo of running processes which indicate if it is running in chroot jail.

    • Creates/modifies environment variables

      Creating/modifying environment variables is a common persistence mechanism.

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

    • Modifies rc script

      Adding/modifying system rc scripts is a common persistence mechanism.

    • Modifies systemd

      Adds/ modifies systemd service files. Likely to achieve persistence.

    • Modifies Bash startup script

MITRE ATT&CK Enterprise v15

Tasks