General
- Target bins.sh
- Size 1KB
- Sample261003-tgvpcasblf
- SHA256 5c107b54a0d4829dcb5ea0618217b69b28659902a629be2ec3967f49e13b48a6
Malware Config
Targets
-
- Target bins.sh
- Size 1KB
- SHA256 5c107b54a0d4829dcb5ea0618217b69b28659902a629be2ec3967f49e13b48a6
Score10/10-
Detects GoDDoSAgent
-
Family: GoDDoSAgent
GoDDoSAgent is a Linux botnet written in GoLang.
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Write file to user bin folder
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Privilege Escalation
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Virtualization/Sandbox Evasion
1System Checks
1