General
- Target 2026-09-29_4be4f11ccb1c84f75d7a2f931b388ca0_bashlite_dofloo_glassworm_helldown_hiatusrat_mirai
- Size 604KB
- Sample260930-b2srdasv3n
- SHA256 d760940c8535ce08ea51a581abda4a1aeaf9351b020e4e86e4a64f312ec36185
- MD5 4be4f11ccb1c84f75d7a2f931b388ca0
- SHA1 41a7ef3e37476e5145deefa89881a01da49a66ff
- SHA512 43fe3909a373cc9e6179fdb874e892bbd0b42dc48477c6acc0e90a80d2bf2aab00c6f296335557779b42f77f389d2d45b4dea9569d5c7f8795ca0cd302484358
- SSDEEP 12288:3d+XaCWOaeK6yLz0Rn24qlJ32b3SQobEeq+VE:3dS2V96wzgbvBeq
- TLSH T16FD46D0769F484BEC8D6C0744B8B933A9962F08A2139F68FF7C6AEC17E15E50A71D741
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-09-29_4be4f11ccb1c84f75d7a2f931b388ca0_bashlite_dofloo_glassworm_helldown_hiatusrat_mirai
Resource
ubuntu1804-amd64-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-29_4be4f11ccb1c84f75d7a2f931b388ca0_bashlite_dofloo_glassworm_helldown_hiatusrat_mirai
- Size 604KB
- SHA256 d760940c8535ce08ea51a581abda4a1aeaf9351b020e4e86e4a64f312ec36185
- MD5 4be4f11ccb1c84f75d7a2f931b388ca0
- SHA1 41a7ef3e37476e5145deefa89881a01da49a66ff
- SHA512 43fe3909a373cc9e6179fdb874e892bbd0b42dc48477c6acc0e90a80d2bf2aab00c6f296335557779b42f77f389d2d45b4dea9569d5c7f8795ca0cd302484358
- SSDEEP 12288:3d+XaCWOaeK6yLz0Rn24qlJ32b3SQobEeq+VE:3dS2V96wzgbvBeq
- TLSH T16FD46D0769F484BEC8D6C0744B8B933A9962F08A2139F68FF7C6AEC17E15E50A71D741
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
2RC Scripts
2Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
2RC Scripts
2Scheduled Task/Job
1Cron
1