Overview

overview

10

Static

static

1

c6cf1908f9...9dfbaN

ubuntu-18.04-amd64

7

c6cf1908f9...9dfbaN

debian-9-armhf

10

c6cf1908f9...9dfbaN

debian-9-mips

10

c6cf1908f9...9dfbaN

debian-9-mipsel

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c6cf1908f96405fd4cca559c8ae9bcdb12d5919bcbd510d1bbe8d1135779dfbaN

  • Size

    6KB

  • Sample

    250117-bbpxsswres

  • MD5

    eae738a54a07452e9aa656c690512980

  • SHA1

    0051ca1fa59d4c857364b541f5cc9b4d483f15bf

  • SHA256

    c6cf1908f96405fd4cca559c8ae9bcdb12d5919bcbd510d1bbe8d1135779dfba

  • SHA512

    ad972376828b5a2c928c12069a17cd35ce8243521691da65eb9435e5a26b8883d4a6c53711869e7b81ef077dde28f887ace7dfbb3634bd960bc7b53ff5749f80

  • SSDEEP

    192:o+yjg4p9ehSerXOKDj7V9NoB8lvjW9cPHRzUlx:xflLAKHIx

Score
10/10
merlinantivmbackdoordefense_evasiondiscoverylinuxupx

Malware Config

Targets

    • Target

      c6cf1908f96405fd4cca559c8ae9bcdb12d5919bcbd510d1bbe8d1135779dfbaN

    • Size

      6KB

    • MD5

      eae738a54a07452e9aa656c690512980

    • SHA1

      0051ca1fa59d4c857364b541f5cc9b4d483f15bf

    • SHA256

      c6cf1908f96405fd4cca559c8ae9bcdb12d5919bcbd510d1bbe8d1135779dfba

    • SHA512

      ad972376828b5a2c928c12069a17cd35ce8243521691da65eb9435e5a26b8883d4a6c53711869e7b81ef077dde28f887ace7dfbb3634bd960bc7b53ff5749f80

    • SSDEEP

      192:o+yjg4p9ehSerXOKDj7V9NoB8lvjW9cPHRzUlx:xflLAKHIx

    Score
    10/10
    discoverymerlinantivmbackdoordefense_evasionupx

    • Merlin

      Merlin is a cross-platform post-exploitation C2 framework written in golang.

      backdoormerlin

    • Merlin family

      merlin

    • Merlin payload

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

      defense_evasion

    • Executes dropped EXE

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks