triplecross | 22d847b0933323d38385b22b77b32c73f91e9e6d92d6ba9da1ed753f8f9ad781

General

Target
22d847b0933323d38385b22b77b32c73f91e9e6d92d6ba9da1ed753f8f9ad781
Size 22KB
Sample260706-pmjrtae17v
SHA256 22d847b0933323d38385b22b77b32c73f91e9e6d92d6ba9da1ed753f8f9ad781
MD5 dbb34c62838c325ef16d8ad174cedbd4
SHA1 0fa6bad19a6a3b188bcfc649542b217d63db852e
SHA512 a4e801b032acc7aeac9efedd852639e7b34ecde2a01b6f78a338db8ce21b32f77b439d1bdbe16c21615b5f5acc05b82c0a424e4d62e2ba3f95cb2d0a18fb7bc2
SSDEEP 384:w699F8ICXtC9fVdXLm6LPOHN1s2DAtjs+jREtCKJmVNjISVOzZ2mKGmX/xQg+Y12:w699aIWC9td7maIfDT+dERJmn7eQB+7V
TLSH
T167B2E14ED375B519C52ECF233BD9A42E139508B0016DBCCA2A3FE550EECB849D625573
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: TripleCross
TripleCross is an open-source eBPF-based Linux rootkit.
rootkit triplecross

Detects TripleCross rootkit 1 IoCs

resource	yara_rule
static1/unpack001/703d57d8a3d3af0ed4c5fd4c35f10a905d67d57619ec032e12f87715928172db_unpacked	family_triplecross

22d847b0933323d38385b22b77b32c73f91e9e6d92d6ba9da1ed753f8f9ad781

.zip 22KB
703d57d8a3d3af0ed4c5fd4c35f10a905d67d57619ec032e12f87715928172db_unpacked

.elf 66KB

SHA256 22d847b0933323d38385b22b77b32c73f91e9e6d92d6ba9da1ed753f8f9ad781
MD5 dbb34c62838c325ef16d8ad174cedbd4
SHA1 0fa6bad19a6a3b188bcfc649542b217d63db852e
SHA512 a4e801b032acc7aeac9efedd852639e7b34ecde2a01b6f78a338db8ce21b32f77b439d1bdbe16c21615b5f5acc05b82c0a424e4d62e2ba3f95cb2d0a18fb7bc2
SSDEEP 384:w699F8ICXtC9fVdXLm6LPOHN1s2DAtjs+jREtCKJmVNjISVOzZ2mKGmX/xQg+Y12:w699aIWC9td7maIfDT+dERJmn7eQB+7V
TLSH
T167B2E14ED375B519C52ECF233BD9A42E139508B0016DBCCA2A3FE550EECB849D625573
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected