Extracted

• • Target
    apt-task.elf
  • Size 8.0MB
  • SHA256 c1925948920c1d753f887a1ec4d32488f059f08acc0a98baa2025bddecb34678
  • MD5 1a95ba7df644a2dbc05bae392200008e
  • SHA1 2444029a1e1d3e2039b1eeb484d842bca17b73b7
  • SHA512 e964694bec14717c3dd22283630484a02378fdc8c7730f970d411888e0ead836f3fae3cffe8c390322293d29b5646713c3cf6e84a3158c9fd5b424942d290b68
  • SSDEEP 49152:18M+q/H2c6MeLqLNLuXG+w7i4lnHW6sgWAUpvqkHZD8WetxQVe52yakUsZ+9NQPC:18Mjv2P0eDZDEuZHkOesj3gRBQUpEn
  • TLSH
    T11B864A57EDA555E8C0ADD13189B39623BB717C490B3023D32B60F6283F76BD06ABA354
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiongovtipersistenceprivilege_escalationstealer

  • Family: GovTI

    GovTI is a Linux stealer written in Golang.

    stealergovti

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Write file to user bin folder

    persistence
  behavioral1