General

  • Target
    VMware-Workstation-Full-26H1-25388281.x86_64.bundle
  • Size 325.0MB
  • Sample260701-xta29aex8w
  • SHA256 3f6d2501e654dbc7701a8290ff6ffcfba6c5444cd5f35f4933cd08c9499f6d84
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

    • Target
      VMware-Workstation-Full-26H1-25388281.x86_64.bundle
    • Size 325.0MB
    • SHA256 3f6d2501e654dbc7701a8290ff6ffcfba6c5444cd5f35f4933cd08c9499f6d84
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Executes dropped EXE

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

    • Deletes log files

      Deletes log files on the system.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

    • Reads list of loaded kernel modules

      Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

    • Write file to user bin folder

MITRE ATT&CK Enterprise v16

Tasks