General
- Target b3232d2cd03b051c59aef952ecfea3358c172351a27a989df31720395c3cbb4a.elf
- Size 1.7MB
- Sample260722-3hyxtsap5y
- SHA256 b3232d2cd03b051c59aef952ecfea3358c172351a27a989df31720395c3cbb4a
Malware Config
Targets
-
- Target b3232d2cd03b051c59aef952ecfea3358c172351a27a989df31720395c3cbb4a.elf
- Size 1.7MB
- SHA256 b3232d2cd03b051c59aef952ecfea3358c172351a27a989df31720395c3cbb4a
Score9/10Contacts a large (133514) amount of remote hosts
This may indicate a network scan to discover remotely running services.
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
Creates Raw socket
Creates a socket that captures raw packets at the device level
Flushes firewall rules
Flushes/ disables firewall rules inside the Linux kernel.
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Enumerates running processes
Discovers information about currently running processes on the system
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
Reads network interface configuration
Fetches information about one or more active network interfaces.
MITRE ATT&CK Enterprise v16
Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Virtualization/Sandbox Evasion
2System Checks
2