General

  • Target
    176.65.139.68_sample.bin
  • Size 2.1MB
  • Sample260510-pcfbmsax6k
  • SHA256 91a62cbcc0bd9628da12416edf34ed9ae18008cb060093ab7543c9c461b759b1
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

    • Target
      176.65.139.68_sample.bin
    • Size 2.1MB
    • SHA256 91a62cbcc0bd9628da12416edf34ed9ae18008cb060093ab7543c9c461b759b1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Contacts a large (11448) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Creates/modifies environment variables

      Creating/modifying environment variables is a common persistence mechanism.

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

    • Modifies systemd

      Adds/ modifies systemd service files. Likely to achieve persistence.

    • Writes file to system bin folder

    • Modifies Bash startup script

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks