General
- Target 54f9e3f12782887a107741e25de61094755214012613b4511aef13b2d95f7319.bin
- Size 68KB
- Sample260905-dtm72awbne
- SHA256 54f9e3f12782887a107741e25de61094755214012613b4511aef13b2d95f7319
- MD5 c0736583d7062cfb22f48fe343ffc279
- SHA1 4cc08d7461a15390ddc0502ad8bdd8779b780ab8
- SHA512 100bc90581349522c8b88aaff48ee581ec83b74c125ff675ddc222f965199edc02bb7aafa9feeb825b346bf1b2f62dc4f86a2caff0f7b909e6692ec724059142
- SSDEEP 1536:IMyCfZ3BJZQvMBB/ujtj7/Cs9M0MINt4o3Z:JpfZxJOkBBMtjt9MDINt/J
- TLSH T1B36302D786FFA8F4DCFDD5B321CE2881CD085222948657152BDD68BD88E2727AD32243
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
54f9e3f12782887a107741e25de61094755214012613b4511aef13b2d95f7319.bin
Resource
ubuntu1804-amd64-20260513-en
Malware Config
Targets
-
- Target 54f9e3f12782887a107741e25de61094755214012613b4511aef13b2d95f7319.bin
- Size 68KB
- SHA256 54f9e3f12782887a107741e25de61094755214012613b4511aef13b2d95f7319
- MD5 c0736583d7062cfb22f48fe343ffc279
- SHA1 4cc08d7461a15390ddc0502ad8bdd8779b780ab8
- SHA512 100bc90581349522c8b88aaff48ee581ec83b74c125ff675ddc222f965199edc02bb7aafa9feeb825b346bf1b2f62dc4f86a2caff0f7b909e6692ec724059142
- SSDEEP 1536:IMyCfZ3BJZQvMBB/ujtj7/Cs9M0MINt4o3Z:JpfZxJOkBBMtjt9MDINt/J
- TLSH T1B36302D786FFA8F4DCFDD5B321CE2881CD085222948657152BDD68BD88E2727AD32243
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Modifies the /etc/hosts DNS resolution file
Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1