24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Linux.Generic Sample f3b0da965a40… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f3b0da965a40…. Malware family: Trojan.Linux.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 5 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703","keywords":["Malicious","Trojan.Linux.Generic","malware analysis","sandbox report","threat intelligence","f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703"],"about":{"@type":"SoftwareApplication","name":"bounty-65912479641488819","applicationCategory":["elf","64bits","executable"],"identifier":"f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Linux.Generic","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5d0,Calls a syscall: "clone" Calls a syscall: "set_robust_list" Calls a syscall: "mmap" Calls a syscall: "munmap" Calls a syscall: "mprotect" Calls a syscall: "nanosleep" Calls a syscall: "execve" Calls a syscall: "brk" Calls a syscall: "access" Calls a syscall: "open" Calls a syscall: "fstat" Calls a syscall: "close" Calls a syscall: "read" Calls a syscall: "arch_prctl" Calls a syscall: "set_tid_address" Calls a syscall: "rt_sigaction" Calls a syscall: "rt_sigprocmask" Calls a syscall: "getrlimit" Calls a syscall: "exit_group" Calls a syscall: "procexit" Calls a syscall: "umask" Calls a syscall: "setsid" Calls a syscall: "dup" Calls a syscall: "socket" Calls a syscall: "chdir" Calls a syscall: "write" Calls a syscall: "futex" Calls a syscall: "wait4" Calls a syscall: "bind" Calls a syscall: "getsockname" Calls a syscall: "sendto" Calls a syscall: "recvmsg" Calls a syscall: "geteuid" Calls a syscall: "lseek" Calls a syscall: "getcwd" Calls a syscall: "clock_gettime" Calls a syscall: "socketpair" Calls a syscall: "poll" Calls a syscall: "uname" Calls a syscall: "pipe" Calls a syscall: "fcntl" Calls a syscall: "connect" Calls a syscall: "getsockopt" Calls a syscall: "getpeername" Calls a syscall: "setsockopt" Calls a syscall: "stat" Calls a syscall: "getuid" Calls a syscall: "ioctl" Calls a syscall: "readlink" Calls a syscall: "sysinfo" Calls a syscall: "sigaltstack" Calls a syscall: "getdents" Calls a syscall: "lstat"26:Te56,Found reference to API "libpthread.so.0" (Indicator: "read"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "pthread_mutex_destroy" (Indicator: "read"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "recvfrom" (Indicator: "recvfrom"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "pthread_mutex_init" (Indicator: "read"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "pthread_mutex_lock" (Indicator: "read"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "accept" (Indicator: "accept"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "fcntl" (Indicator: "fcntl"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "pthread_create" (Indicator: "creat"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "pthread_create" (Indicator: "read"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "pthread_join" (Indicator: "read"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "connect" (Indicator: "connect"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "pthread_detach" (Indicator: "read"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "sendto" (Indicator: "sendto"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "pthread_mutex_unlock" (Indicator: "read"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "lseek" (Indicator: "lseek"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "dlclose" (Indicator: "close"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "dlopen" (Indicator: "open"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "socket" (Indicator: "socket"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "gmtime_r" (Indicator: "time"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "readdir" (Indicator: "read"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "fopen" (Indicator: "open"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "closedir" (Indicator: "close"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "listen" (Indicator: "listen"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "select" (Indicator: "select"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "socketpair" (Indicator: "socket"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "socketpair" (Indicator: "socketpair"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin") Found reference to API "popen" (Indicator: "open"; File: "f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703.bin")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790795937096,"unified_at":"2026-09-30T19:18:57.096Z","metadata":{"hashes":{"sha256":"f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703","sha1":"6f391d282a37b770abcedd08c4c0e2156076cd8e","md5":"6f2f61783a4a59449db4ba37211fa331","sha512":"60243c6b5144aea73deb99a77451fecc6d48b7235390033146da26ae0db45dfa0fa409adf8a92c77301400114e61468066857895386f300cb105ae7915fd300c","ssdeep":"49152:BcRBaIzf8VB1KGq46n5YTqqFIPIU43IvBqHkD/ARMa6DTbeFY1tKd3TR1y1++Iq2:IBTp54hTqqFIP1BvB2ocMa6LeFY1tKdp","ssdeep_chunks":["49152:BcRBaIz","49152:cRBaIzf","49152:RBaIzf8","49152:BaIzf8V","49152:aIzf8VB","49152:Izf8VB1","49152:zf8VB1K","49152:f8VB1KG","49152:8VB1KGq","49152:VB1KGq4","49152:B1KGq46","49152:1KGq46n","49152:KGq46n5","49152:Gq46n5Y","49152:q46n5YT","49152:46n5YTq","49152:6n5YTqq","49152:n5YTqqF","49152:5YTqqFI","49152:YTqqFIP","49152:TqqFIPI","49152:qqFIPIU","49152:qFIPIU4","49152:FIPIU43","49152:IPIU43I","49152:PIU43Iv","49152:IU43IvB","49152:U43IvBq","49152:43IvBqH","49152:3IvBqHk","49152:IvBqHkD","49152:vBqHkD/","49152:BqHkD/A","49152:qHkD/AR","49152:HkD/ARM","49152:kD/ARMa","49152:D/ARMa6","49152:/ARMa6D","49152:ARMa6DT","49152:RMa6DTb","49152:Ma6DTbe","49152:a6DTbeF","49152:6DTbeFY","49152:DTbeFY1","49152:TbeFY1t","49152:beFY1tK","49152:eFY1tKd","49152:FY1tKd3","49152:Y1tKd3T","49152:1tKd3TR","49152:tKd3TR1","49152:Kd3TR1y","49152:d3TR1y1","49152:3TR1y1+","49152:TR1y1++","49152:R1y1++I","49152:1y1++Iq","49152:y1++Iq2","98304:BcRBaIz","98304:cRBaIzf","98304:RBaIzf8","98304:BaIzf8V","98304:aIzf8VB","98304:Izf8VB1","98304:zf8VB1K","98304:f8VB1KG","98304:8VB1KGq","98304:VB1KGq4","98304:B1KGq46","98304:1KGq46n","98304:KGq46n5","98304:Gq46n5Y","98304:q46n5YT","98304:46n5YTq","98304:6n5YTqq","98304:n5YTqqF","98304:5YTqqFI","98304:YTqqFIP","98304:TqqFIPI","98304:qqFIPIU","98304:qFIPIU4","98304:FIPIU43","98304:IPIU43I","98304:PIU43Iv","98304:IU43IvB","98304:U43IvBq","98304:43IvBqH","98304:3IvBqHk","98304:IvBqHkD","98304:vBqHkD/","98304:BqHkD/A","98304:qHkD/AR","98304:HkD/ARM","98304:kD/ARMa","98304:D/ARMa6","98304:/ARMa6D","98304:ARMa6DT","98304:RMa6DTb","98304:Ma6DTbe","98304:a6DTbeF","98304:6DTbeFY","98304:DTbeFY1","98304:TbeFY1t","98304:beFY1tK","98304:eFY1tKd","98304:FY1tKd3","98304:Y1tKd3T","98304:1tKd3TR","98304:tKd3TR1","98304:Kd3TR1y","98304:d3TR1y1","98304:3TR1y1+","98304:TR1y1++","98304:R1y1++I","98304:1y1++Iq","98304:y1++Iq2","49152:IBTp54h","49152:BTp54hT","49152:Tp54hTq","49152:p54hTqq","49152:54hTqqF","49152:4hTqqFI","49152:hTqqFIP","49152:TqqFIP1","49152:qqFIP1B","49152:qFIP1Bv","49152:FIP1BvB","49152:IP1BvB2","49152:P1BvB2o","49152:1BvB2oc","49152:BvB2ocM","49152:vB2ocMa","49152:B2ocMa6","49152:2ocMa6L","49152:ocMa6Le","49152:cMa6LeF","49152:Ma6LeFY","49152:a6LeFY1","49152:6LeFY1t","49152:LeFY1tK","49152:FY1tKdp"],"imphash":"Unknown"},"file_info":{"file_name":"bounty-65912479641488819","file_type":["elf","64bits","executable"],"file_type_id":"64-bit elf","file_size":2818000,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1681458300000,"last_seen":1686265116000,"last_multi_scan":1686265116000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["backdoor"]},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":15},"sandbox_signatures":{"informative_count":14,"suspicious_count":5,"malicious_count":5,"total":24},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Linux.NukeSped.f","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"LINUX/Agent.gtveq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Linux.Generic.297560","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"linux/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Linux.Generic.297560 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Linux/NukeSped.F trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!603FE857082D301B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Linux.Agent.nb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Trojan.8685B618","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Trojan.8685B618","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Linux.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls native functions (syscalls)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"}],"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Contains ability to set the socket options (syscall string)"}],"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"tactic":"Defense Evasion","technique":"Linux and Mac File and Directory Permissions Modification","attack_id":"T1222.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1222/002","identifiers":[{"type":"informative","value":"Sets default file mode creation mask"}],"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"YARA signature match - AES Encryption"}],"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"tactic":"Credential Access","technique":"/etc/passwd and /etc/shadow","attack_id":"T1003.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/008","identifiers":[{"type":"suspicious","value":"Reads users database (/etc/passwd file) (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Calls a system call typically used to retrieve the current address to which the socket is bound"}],"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Gets user and/or group ID (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Queries system general information (syscall)"},{"type":"suspicious","value":"YARA signature match - Ldpreload backdoor"}],"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Queries socket options"}],"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Modifies socket options"}],"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]}],"sandbox_signatures":[{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"informative","category":"Environment Awareness","name":"Gets user and/or group ID (syscall)","description":"/tmp/bounty-65912elf used: geteuid\n /tmp/bounty-65912elf used: getuid","origin":"API Call","mitre_attack_id":"T1033","id":"api-1004","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"informative","category":"General","name":"Calls native functions (syscalls)","description":"$25","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-1150","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-5000","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"informative","category":"General","name":"Sets default file mode creation mask","description":"/tmp/bounty-65912elf set umask","origin":"API Call","mitre_attack_id":"T1222.002","id":"api-1147","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"apdl.cf\" has type \"ISO-8859 text with very long lines with no line terminators\"- [targetUID: 12238069-1629]\n \"log.md\" has type \"ASCII text\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"/tmp/bounty-65912elf reads file /lib/x86_64-linux-gnu/libpthread.so.0\n /tmp/bounty-65912elf reads file /lib/x86_64-linux-gnu/libdl.so.2\n /tmp/bounty-65912elf reads file /usr/lib/x86_64-linux-gnu/libstdc++.so.6\n /tmp/bounty-65912elf reads file /lib/x86_64-linux-gnu/libm.so.6\n /tmp/bounty-65912elf reads file /lib/x86_64-linux-gnu/libgcc_s.so.1\n /tmp/bounty-65912elf reads file /lib/x86_64-linux-gnu/libc.so.6\n /tmp/bounty-65912elf reads file <4t>192.168.242.58:37514->58.158.177.102:443\n /tmp/bounty-65912elf reads file

\n /tmp/bounty-65912elf reads file <4t>192.168.242.58:37486->58.158.177.102:443\n /tmp/bounty-65912elf reads file <4t>192.168.242.58:37488->58.158.177.102:443\n /tmp/bounty-65912elf reads file /etc/nsswitch.conf","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-1156","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"informative","category":"Network Related","name":"Calls a system call typically used to retrieve the current address to which the socket is bound","description":"/tmp/bounty-65912elf executed: getsockname","origin":"API Call","mitre_attack_id":"T1016","relevance":3,"id":"api-1152","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set the socket options (syscall string)","description":"Observed string: \"setsockopt\" (Indicator: \"setsockopt\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-5002","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://h\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"informative","category":"Network Related","name":"Queries socket options","description":"/tmp/bounty-65912elf uses: getsockopt","origin":"API Call","mitre_attack_id":"T1049","id":"api-1007","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries system general information (syscall)","description":"/tmp/bounty-65912elf used: uname","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-1006","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"26/62 Antivirus vendors marked sample as malicious (41% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"suspicious","category":"Network Related","name":"Modifies socket options","description":"/tmp/bounty-65912elf uses: setsockopt","origin":"API Call","mitre_attack_id":"T1095","relevance":3,"id":"api-1008","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Ldpreload backdoor","description":"YARA signature ldpreload classified file as backdoor","origin":"YARA Signature","mitre_attack_id":"T1082","relevance":3,"id":"yara-106","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads users database (/etc/passwd file) (syscall)","description":"bounty-65912elf reads: /etc/passwd","origin":"API Call","mitre_attack_id":"T1003.008","relevance":10,"id":"api-1009","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Discards command(s) output","description":"/tmp/bounty-65912elf opened: /dev/null","origin":"API Call","relevance":10,"id":"api-1048","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: linux/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"26/62 Antivirus vendors marked sample as malicious (41% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"level":"malicious","category":"Installation/Persistence","name":"Creates a daemon out of the process (syscall)","description":"/tmp/bounty-65912elf daemonizes itself into background with: setsid","origin":"API Call","relevance":3,"id":"api-1003","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries system general information (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]}]},"activity":{"stats":{"process_count":22,"spawned_processes_count":22,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["backdoor"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"64825b911c08ca8a5c06ae80","environment_id":300,"environment_description":"Linux (Ubuntu 16.04, 64 bit)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Linux.Generic","submit_name":"bounty-65912479641488819","analysis_start_time":"2023-06-08T22:52:02+00:00","indicators_count":{"informative":14,"suspicious":5,"malicious":5},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}],"processes":[{"pid":1632,"ppid":0,"name":"bounty-65912elf","command_line":"","normalized_path":"/tmp/bounty-65912elf","uid":"1418244-1632"},{"pid":1628,"ppid":0,"name":"bounty-65912elf","command_line":"","normalized_path":"/tmp/bounty-65912elf","uid":"10358020-1628"},{"pid":1629,"ppid":0,"name":"bounty-65912elf","command_line":"","normalized_path":"/tmp/bounty-65912elf","uid":"12238069-1629"},{"pid":1630,"ppid":0,"name":"bounty-65912elf","command_line":"","normalized_path":"/tmp/bounty-65912elf","uid":"12778102-1630"},{"pid":1636,"ppid":1630,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"12778102-1630","uid":"16562279-1636"},{"pid":1699,"ppid":1630,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"12778102-1630","uid":"55382950-1699"},{"pid":1675,"ppid":1630,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"12778102-1630","uid":"249982900-1675"},{"pid":1679,"ppid":1630,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"12778102-1630","uid":"295799411-1679"},{"pid":1682,"ppid":1630,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"12778102-1630","uid":"337267356-1682"},{"pid":1693,"ppid":1630,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"12778102-1630","uid":"487575907-1693"},{"pid":1696,"ppid":1630,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"12778102-1630","uid":"521178458-1696"},{"pid":1702,"ppid":1630,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"12778102-1630","uid":"587527495-1702"},{"pid":1713,"ppid":1630,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"12778102-1630","uid":"723106035-1713"},{"pid":1716,"ppid":1630,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"12778102-1630","uid":"759989998-1716"},{"pid":1719,"ppid":1630,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"12778102-1630","uid":"792532775-1719"},{"pid":1722,"ppid":1630,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"12778102-1630","uid":"825619992-1722"},{"pid":1733,"ppid":1630,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"12778102-1630","uid":"968935136-1733"},{"pid":1736,"ppid":1630,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"12778102-1630","uid":"1002557940-1736"},{"pid":1747,"ppid":1630,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"12778102-1630","uid":"1052134285-1747"},{"pid":1750,"ppid":1630,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"12778102-1630","uid":"1091307049-1750"},{"pid":1631,"ppid":0,"name":"bounty-65912elf","command_line":"","normalized_path":"/tmp/bounty-65912elf","uid":"13469113-1631"},{"pid":1633,"ppid":0,"name":"bounty-65912elf","command_line":"","normalized_path":"/tmp/bounty-65912elf","uid":"14801248-1633"}],"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"apdl.cf","sha256":"269f70808aba609541d7559181b9c7e7102e36e22aa31878fa1747c2bfaf60b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"name":"log.md","sha256":"0f0ac0ad07d80e937c77d7025fbe0b47e0f3a90c6316d5f13c7d1826cc8c7419","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]}],"files_written":[{"path":"/etc/apdl.cf","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]},{"path":"/tmp/xweb_log.md","sources":[{"report_type":"sandbox","report_id":"64825b911c08ca8a5c06ae80"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["64825b911c08ca8a5c06ae80"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Linux.Generic Sample f3b0da965a40… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f3b0da965a40…. Malware family: Trojan.Linux.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 5 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Linux.Generic Sample f3b0da965a40… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f3b0da965a40…. Malware family: Trojan.Linux.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 5 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Linux.Generic Sample f3b0da965a40… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f3b0da965a40…. Malware family: Trojan.Linux.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 5 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]