General
- Target agent-full-x86_64
- Size 192KB
- Sample260731-ja18faeg99
- SHA256 66249bad655bcd7d14339214b8fa4fce01ab11afe3e76656caa5a247aa4d28ce
- MD5 583662c706d0e66c6bac77deb17688fd
- SHA1 a5abe2be94f7e512a825eb899fd78e04b185118a
- SHA512 93fce6ad9148e99339e267efb1c9657298e483e27e1f3ef6321163dda6e67cab16ac2f8353241f55b7de9c4bac65d354628fc3025543eedfb1bb33e73ff1b6c8
- SSDEEP 3072:yp48B6LfUIxCwwFuCwYyvra5a6M214iRcqNjHgFMUT4KoylmAkLucoJoiMyNuxi3:yp4g6g+vyskJ3gyzKNltl6mN7xsLi
- TLSH T10F144913EA9100F8D5DCC6B9435FE133EB6AF88AA115B60B57D46F021F69F64A32D381
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
agent-full-x86_64
Resource
ubuntu2204-amd64-20260513-en
Behavioral task
behavioral2
Sample
agent-full-x86_64
Resource
ubuntu2404-amd64-20260126-en
Malware Config
Targets
-
- Target agent-full-x86_64
- Size 192KB
- SHA256 66249bad655bcd7d14339214b8fa4fce01ab11afe3e76656caa5a247aa4d28ce
- MD5 583662c706d0e66c6bac77deb17688fd
- SHA1 a5abe2be94f7e512a825eb899fd78e04b185118a
- SHA512 93fce6ad9148e99339e267efb1c9657298e483e27e1f3ef6321163dda6e67cab16ac2f8353241f55b7de9c4bac65d354628fc3025543eedfb1bb33e73ff1b6c8
- SSDEEP 3072:yp48B6LfUIxCwwFuCwYyvra5a6M214iRcqNjHgFMUT4KoylmAkLucoJoiMyNuxi3:yp4g6g+vyskJ3gyzKNltl6mN7xsLi
- TLSH T10F144913EA9100F8D5DCC6B9435FE133EB6AF88AA115B60B57D46F021F69F64A32D381
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Adds new SSH keys
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Unix Shell
1Scheduled Task/Job
1Cron
1Persistence
Account Manipulation
1SSH Authorized Keys
1Boot or Logon Autostart Execution
2XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Account Manipulation
1SSH Authorized Keys
1Boot or Logon Autostart Execution
2XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1