General
- Target reaver.x86.elf
- Size 150KB
- Sample260905-dx571swbrc
- SHA256 554317fb54d7c777992869e4a184aed94a54a7a2e44534f6ead0fb3c58e4de19
- MD5 d14808c1532168916b2f5fc7155c9761
- SHA1 e2a512b65f2303c7b6eb95c364587fe339c4c037
- SHA512 0f2c8945ce5c893dfc6e8445dd6a2937a9917e460bbb011bb501affe4b115b453439f03de650a25f9d4809ba835e3fb5266d6ce62f941ed0bf7a3b5eb30490c7
- SSDEEP 3072:6pP4hkkO+/BZYJomikBQenNl1J0JGGaSyc+B5ApKubMPOrVc:6pc6IZYJNhrl1J0J6tHYrMPOO
- TLSH T118E36B06E713D0F1D84A15B001FB9B358E78EC735536DA06EBB57FB19E21A81A61A33C
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
reaver.x86.elf
Resource
ubuntu1804-amd64-20260513-en
Malware Config
Targets
-
- Target reaver.x86.elf
- Size 150KB
- SHA256 554317fb54d7c777992869e4a184aed94a54a7a2e44534f6ead0fb3c58e4de19
- MD5 d14808c1532168916b2f5fc7155c9761
- SHA1 e2a512b65f2303c7b6eb95c364587fe339c4c037
- SHA512 0f2c8945ce5c893dfc6e8445dd6a2937a9917e460bbb011bb501affe4b115b453439f03de650a25f9d4809ba835e3fb5266d6ce62f941ed0bf7a3b5eb30490c7
- SSDEEP 3072:6pP4hkkO+/BZYJomikBQenNl1J0JGGaSyc+B5ApKubMPOrVc:6pc6IZYJNhrl1J0J6tHYrMPOO
- TLSH T118E36B06E713D0F1D84A15B001FB9B358E78EC735536DA06EBB57FB19E21A81A61A33C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Modifies the /etc/hosts DNS resolution file
Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1