General
- Target libgdi.so.0.8.2
- Size 5.0MB
- Sample260826-nt141adb28
- SHA256 c3b15ced11fc3ca5db7bc55cf8d0de19c0d58d0171d9e95b1aa34c45026ef485
- MD5 1018f96b8077eb97216375c471f0ac6a
- SHA1 cccc69dcf00e92df3400e0421e8173db6b9b1baf
- SHA512 4eda9aa291da09d83a7ab1a5c4271c78858c11d9e632158379a6af138ba371e680ca48272b3468284e7dce50818a12535bd56566ec31b568a8f5d9b46392df8e
- SSDEEP 49152:FGKPMxchyyTrCXDMrTZ3+tVNfEP2KmpAX5EWOigY/zA95xwR:TMmhyyTSe3+BnkExvxa
- TLSH T169363A57EC9586E9D0EAD1308A629252BB717C485B3123D72F90F7783F72BD0AA79340
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
libgdi.so.0.8.2
Resource
ubuntu2404-amd64-20260127-en
6 signatures
300 seconds
Malware Config
Targets
-
- Target libgdi.so.0.8.2
- Size 5.0MB
- SHA256 c3b15ced11fc3ca5db7bc55cf8d0de19c0d58d0171d9e95b1aa34c45026ef485
- MD5 1018f96b8077eb97216375c471f0ac6a
- SHA1 cccc69dcf00e92df3400e0421e8173db6b9b1baf
- SHA512 4eda9aa291da09d83a7ab1a5c4271c78858c11d9e632158379a6af138ba371e680ca48272b3468284e7dce50818a12535bd56566ec31b568a8f5d9b46392df8e
- SSDEEP 49152:FGKPMxchyyTrCXDMrTZ3+tVNfEP2KmpAX5EWOigY/zA95xwR:TMmhyyTSe3+BnkExvxa
- TLSH T169363A57EC9586E9D0EAD1308A629252BB717C485B3123D72F90F7783F72BD0AA79340
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Privilege Escalation
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1