General

  • Target

    bot.x86.elf

  • Size

    87KB

  • Sample

    250102-b9tnmsypfr

  • MD5

    dd71487c78fb3cc5ab09c350a01d28f7

  • SHA1

    ab30dae9842cfe912461b1fa1a098247babe8e28

  • SHA256

    f3928fd942a8d5e9b9ffaa98e0722903f936eb895a0934ad3a24fe5a4a7495f8

  • SHA512

    ac5e285f1d20f498e7536997349f718d895239d6d4361ac2e97f362dad78abc4dda855fe20b8b306816ca47fa7b9e097ae1157540fb5fb75245563b89af9182e

  • SSDEEP

    1536:xpmWc2AcighsZ82fJxfcUHH1mSsM8y6Q+gBQ9TnkISGtAdy0xZ:xpmX2riED2frf7HVmL1Q1Q9kVTy0x

Malware Config

Extracted

Family

latentbot

C2

botnetdolly.zapto.org

Targets

    • Target

      bot.x86.elf

    • Size

      87KB

    • MD5

      dd71487c78fb3cc5ab09c350a01d28f7

    • SHA1

      ab30dae9842cfe912461b1fa1a098247babe8e28

    • SHA256

      f3928fd942a8d5e9b9ffaa98e0722903f936eb895a0934ad3a24fe5a4a7495f8

    • SHA512

      ac5e285f1d20f498e7536997349f718d895239d6d4361ac2e97f362dad78abc4dda855fe20b8b306816ca47fa7b9e097ae1157540fb5fb75245563b89af9182e

    • SSDEEP

      1536:xpmWc2AcighsZ82fJxfcUHH1mSsM8y6Q+gBQ9TnkISGtAdy0xZ:xpmX2riED2frf7HVmL1Q1Q9kVTy0x

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

    • Latentbot family

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

MITRE ATT&CK Matrix

Tasks