Overview

overview

9

Static

static

5

pcdn

ubuntu-18.04-amd64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    pcdn
  • Size 5.1MB
  • Sample260825-ph23lahr61
  • SHA256 6c2a884eb6c0c038a57f7a5009586b8edcbd4d20ccc8a886d5ddd40ac770d2ab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
bootkitcommand_and_controldiscoverylinuxpersistenceprivilege_escalationupx

Malware Config

Targets

    • Target
      pcdn
    • Size 5.1MB
    • SHA256 6c2a884eb6c0c038a57f7a5009586b8edcbd4d20ccc8a886d5ddd40ac770d2ab
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    bootkitcommand_and_controldiscoverypersistenceprivilege_escalationupx

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1896) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies kernel boot image

      Overwrites kernel image in the /boot mountpoint.

      bootkit

    • Outbound SSH connection to public host

      SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

      command_and_control

    • Modifies systemd

      Adds/ modifies systemd service files. Likely to achieve persistence.

      persistenceprivilege_escalation

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks