General
- Target SecuriteInfo.com.Heur.4967.5024.elf
- Size 963KB
- Sample260427-ay7kpadw2m
- SHA256 7c1f7e1ad2367a08a5edfdba26e6a7b318252072d25096c818864c822fa9214b
- MD5 4f055d26ceee36bfade41272ff143bb5
- SHA1 0babc6b5cac851e700419c17342b09c19cee66ba
- SHA512 d392e39e2385d53a00f9781f9f9e6266583f3ebbaca9a50d48c0e7d4f181d27196ebf48788b9ec2264b04878387d39fdd9ca1d6b104415d69831c0296aa4f8a4
- SSDEEP 12288:QNalcmpk0/NgwMidbXfdkHhPYOTSyZC5SDR7oEZKohh0USDfrayE/fRvofHXKAT1:3cmp//Ng2UI3s08n2USDyfRQFTBfze
- TLSH T1F5259E2AB2B2B2BDD007C03447DBCBB15532F07556312DBB22C4DB343E9ADA41769B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Heur.4967.5024.elf
Resource
ubuntu1804-amd64-20260126-en
Malware Config
Targets
-
- Target SecuriteInfo.com.Heur.4967.5024.elf
- Size 963KB
- SHA256 7c1f7e1ad2367a08a5edfdba26e6a7b318252072d25096c818864c822fa9214b
- MD5 4f055d26ceee36bfade41272ff143bb5
- SHA1 0babc6b5cac851e700419c17342b09c19cee66ba
- SHA512 d392e39e2385d53a00f9781f9f9e6266583f3ebbaca9a50d48c0e7d4f181d27196ebf48788b9ec2264b04878387d39fdd9ca1d6b104415d69831c0296aa4f8a4
- SSDEEP 12288:QNalcmpk0/NgwMidbXfdkHhPYOTSyZC5SDR7oEZKohh0USDfrayE/fRvofHXKAT1:3cmp//Ng2UI3s08n2USDyfRQFTBfze
- TLSH T1F5259E2AB2B2B2BDD007C03447DBCBB15532F07556312DBB22C4DB343E9ADA41769B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
Enumerates running processes
Discovers information about currently running processes on the system
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
Write file to user bin folder
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1