Overview

overview

8

Static

static

1

station-2..../rules

ubuntu-18.04-amd64

1

station-2..../rules

debian-9-armhf

1

station-2..../rules

debian-9-mips

1

station-2..../rules

debian-9-mipsel

1

station-2....ts.vbs

windows10-2004-x64

5

station-2....ts.vbs

windows11-ltsc_2024-x64

5

station-2....me.svg

windows10-2004-x64

3

station-2....me.svg

windows11-ltsc_2024-x64

4

station-2....on.svg

windows10-2004-x64

3

station-2....on.svg

windows11-ltsc_2024-x64

4

station-2....esktop

ubuntu-18.04-amd64

4

station-2....esktop

debian-9-armhf

station-2....esktop

debian-9-mips

station-2....esktop

debian-9-mipsel

station-2....ild.sh

ubuntu-18.04-amd64

8

station-2....ild.sh

debian-9-armhf

8

station-2....ild.sh

debian-9-mips

7

station-2....ild.sh

debian-9-mipsel

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    station-2.1.1.tar.xz
  • Size 27KB
  • Sample261001-slbxcsxtay
  • SHA256 6035d659f0aebb8f8ac7d6d7574e67b4e8e7d6ac3a94a8b90afeb8cf303f80f9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwareantivmbootkitcredential_accessdefense_evasiondiscoveryexecutionlinuxpersistenceprivilege_escalationspyware

Malware Config

Targets

    • Target
      station-2.1.1/debian/rules
    • Size 52B
    • SHA256 c2615920c7907ae06c4d653cb96f5b8f7c7f840068e526a2729739226a9ef533
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral1behavioral2behavioral3behavioral4
    • Target
      station-2.1.1/src/CMakeLists.txt
    • Size 848B
    • SHA256 401235f92a77eee5eca71444611cf3520cf76f67355f426e0f1bc38dae799e06
    • MD5 SHA1 SHA512 TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral5behavioral6
    • Target
      station-2.1.1/src/assets/edit-rename.svg
    • Size 3KB
    • SHA256 67395755cdc585cda5e02b49ee6fc4f746066b193cc38194f584ad5ed2eee091
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral7behavioral8
    • Target
      station-2.1.1/src/assets/station.svg
    • Size 12KB
    • SHA256 9c210f2c1ae2e217f3d5375072c02538d3998a2ceb2b721b3a87bdf5973f521f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral10behavioral9
    • Target
      station-2.1.1/src/org.kde.station.desktop
    • Size 1KB
    • SHA256 45d825953e9b677262ad565645afdbf0cce380370607367e86f1f8b0c3f6a46a
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    discovery
    behavioral11behavioral12behavioral13behavioral14
    • Target
      station-2.1.1/travis-build.sh
    • Size 1KB
    • SHA256 09d2006da91ef96f1bc8dd4d966e93d5d78d4140d80aa8fa47b480ee840fdc71
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    antivmbootkitcredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

    • Modifies initial root filesystem image

      Overwrites initrd/ initramfs image in the /boot mountpoint.

      bootkit

    • Modifies kernel boot image

      Overwrites kernel image in the /boot mountpoint.

      bootkit

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

      defense_evasion

    • Executes dropped EXE

    • Modifies PAM framework files

      Modifies Linux PAM framework files, possibly to intercept credentials.

      persistencecredential_accessdefense_evasion

    • Modifies Polkit authorization policy

      Rule or action files in the Polkit framework are written to, potentially allowing a process or user to execute privileged operations without requiring authentication.

    • OS Credential Dumping

      Adversaries may attempt to dump credentials to use it in password cracking.

      credential_access

    • Reads AppArmor ptrace settings

      Discovery of allowed ptrace capabilities by AppArmor.

      discovery

    • Checks mountinfo of local process

      Checks mountinfo of running processes which indicate if it is running in chroot jail.

      antivm

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      executionpersistenceprivilege_escalation

    • Creates/modifies environment variables

      Creating/modifying environment variables is a common persistence mechanism.

      persistenceprivilege_escalationdefense_evasion

    • Deletes log files

      Deletes log files on the system.

      defense_evasion

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Reads list of loaded kernel modules

      Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

      defense_evasion

    • Write file to user bin folder

      persistence

    • Writes file to system bin folder

    • Modifies Bash startup script

      persistence
    behavioral15behavioral16behavioral17behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

Unix Shell

1
T1059.004

Visual Basic

1
T1059.005

Scheduled Task/Job

1
T1053

Cron

1
T1053.003

Software Deployment Tools

1
T1072

Persistence

Boot or Logon Autostart Execution

2
T1547

Boot or Logon Initialization Scripts

1
T1037

RC Scripts

1
T1037.004

Event Triggered Execution

1
T1546

Unix Shell Configuration Modification

1
T1546.004

Hijack Execution Flow

1
T1574

Path Interception by PATH Environment Variable

1
T1574.007

Modify Authentication Process

1
T1556

Pluggable Authentication Modules

1
T1556.003

Scheduled Task/Job

1
T1053

Cron

1
T1053.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Sudo and Sudo Caching

1
T1548.003

Boot or Logon Autostart Execution

2
T1547

Boot or Logon Initialization Scripts

1
T1037

RC Scripts

1
T1037.004

Event Triggered Execution

1
T1546

Unix Shell Configuration Modification

1
T1546.004

Hijack Execution Flow

1
T1574

Path Interception by PATH Environment Variable

1
T1574.007

Scheduled Task/Job

1
T1053

Cron

1
T1053.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Sudo and Sudo Caching

1
T1548.003

Deobfuscate/Decode Files or Information

1
T1140

File and Directory Permissions Modification

1
T1222

Linux and Mac File and Directory Permissions Modification

1
T1222.002

Hijack Execution Flow

1
T1574

Path Interception by PATH Environment Variable

1
T1574.007

Indicator Removal

1
T1070

Clear Linux or Mac System Logs

1
T1070.002

Modify Authentication Process

1
T1556

Pluggable Authentication Modules

1
T1556.003

Modify Registry

1
T1112

Virtualization/Sandbox Evasion

3
T1497

System Checks

2
T1497.001

Credential Access

Modify Authentication Process

1
T1556

Pluggable Authentication Modules

1
T1556.003

OS Credential Dumping

1
T1003

/etc/passwd and /etc/shadow

1
T1003.008

Discovery

Browser Information Discovery

1
T1217

Query Registry

1
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

System Time Discovery

1
T1124

Virtualization/Sandbox Evasion

3
T1497

System Checks

2
T1497.001

Lateral Movement

Software Deployment Tools

1
T1072

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
1/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

execution
Score
5/10

behavioral6

execution
Score
5/10

behavioral7

adwarediscoveryspyware
Score
3/10

behavioral8

adwarediscoveryspyware
Score
4/10

behavioral9

adwarediscoveryspyware
Score
3/10

behavioral10

adwarediscoveryspyware
Score
4/10

behavioral11

discovery
Score
4/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

antivmbootkitcredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation
Score
8/10

behavioral16

antivmbootkitcredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation
Score
8/10

behavioral17

credential_accessdefense_evasiondiscoveryexecution
Score
7/10

behavioral18

discoveryexecution
Score
3/10