General
- Target f6b23cd237e6eff4720e9bb1835113b04735092d556dbe89f93a4099229ef77e.zip
- Size 456KB
- Sample260729-3cp3qsxyas
- SHA256 66daf62cb317c87c8a64f0bde56fabad15af0549283ece16bac8736bfac34bd9
Score
10/10
Malware Config
Targets
-
- Target f6b23cd237e6eff4720e9bb1835113b04735092d556dbe89f93a4099229ef77e.elf
- Size 1.2MB
- SHA256 f6b23cd237e6eff4720e9bb1835113b04735092d556dbe89f93a4099229ef77e
Score10/10-
Detects BillGates payload
-
Family: BillGates
BillGates is a Linux botnet.
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
Loads a kernel module
Loads a Linux kernel module, potentially to achieve persistence
-
Modifies init.d
Adds/modifies system service, likely for persistence.
-
Reads system routing table
Gets active network interfaces from /proc virtual filesystem.
-
Write file to user bin folder
-
Writes file to system bin folder
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1