General
- Target i486.elf
- Size 105KB
- Sample260813-cfes3azcnf
- SHA256 47a24d074131c35a8abccb79a958316165a5827b96d446c5d31f1f7b0efa4c4d
Malware Config
Targets
-
- Target i486.elf
- Size 105KB
- SHA256 47a24d074131c35a8abccb79a958316165a5827b96d446c5d31f1f7b0efa4c4d
Score7/10-
Deletes system logs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Disables AppArmor Mandatory Access Control
Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.
-
Modifies the /etc/hosts DNS resolution file
Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Deletes log files
Deletes log files on the system.
-
Disables SELinux
Disables SELinux security module.
-
Enumerates running processes
Discovers information about currently running processes on the system
MITRE ATT&CK Enterprise v16
Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Indicator Removal
2Clear Linux or Mac System Logs
2Virtualization/Sandbox Evasion
2System Checks
2