General
- Target .X0-lock_x86_64.elf
- Size 1.4MB
- Sample260811-h89rssdb83
- SHA256 7761a32cbc96fb28a0c4268376e52819fa8874724ade80b1a20be9ab38d8ca12
Malware Config
Targets
-
- Target .X0-lock_x86_64.elf
- Size 1.4MB
- SHA256 7761a32cbc96fb28a0c4268376e52819fa8874724ade80b1a20be9ab38d8ca12
Score9/10-
Modifies the dynamic linker configuration file
Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
2Dynamic Linker Hijacking
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
2Dynamic Linker Hijacking
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
Hijack Execution Flow
2Dynamic Linker Hijacking
1Path Interception by PATH Environment Variable
1