← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Request for verification - Production Archlinux delivering malware spiked systemd library
WHITE Merkd1904 2024-04-18 Modified: 2024-04-23
99
IOCs
HIGH VOLUME
I was mainly making this pulse to ask for a second pair of eyes. or as many pairs of eyes as possible to take a look to verify the VT and HA detentions. But with OTX parsing the data it seems to be open and shut. For posterity; Can anyone independently verify these? The files are on disk and actively being distributed via Arch's mirrors.
sandboxmalwareanalysisonlinesubmitvxstreamsampledownloadtrojanaptmemoryfile scanansifileindicatordatepcappcap processingthreat levelupdatesha256suspicioushybridcryptocloseclickaprilstringsmaliciousfebruarymiddleexploitgameovercontactpleasejavascriptbpf programbpf firewallingbpffallowmultibpf deviceck ida ansipathluks deviceuuidluks superblockluksjson recordpkcsweird
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Backdoor:Linux/Gafgyt DDoS:Linux/Gafgyt Trojan:Linux/Gafgyt Gafgyt necrobot Backdoor:Linux/Mirai Mirai Mirai (ELF) ELF:Mirai-AAU\ [Trj] Unix.Trojan.Mirai-5607483-0 Other:Malware-gen\ [Trj] Unix.Trojan.Mirai-5932143-0 Unix.Malware.Agent-7006122-0 Unix.Dropper.Mirai-7338044-0 Unix.Malware.Agent-7005780-0 Unix.Trojan.Mirai-6976991-0 CoinMiner DDoS:Linux/Lightaidra Py.Trojan.NecroBot-9868091-0 ELF/Sakura, Gafygt ELF:Agent-AWA\ [Trj]
Indicators of Compromise (99)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 CVE URL domain email hostname
TYPEINDICATORDESCRIPTIONCREATED
FileHash-MD5 8995957c2614eba3398d77b794e39872 MD5 of c002e77a1448c0826f3373a10ee2eb130ce17fc7ab1a048feb84571a01f34411 2024-04-18
FileHash-SHA1 af64d736739ccd2ff5aa4e381b18d55af0a36dd0 SHA1 of c002e77a1448c0826f3373a10ee2eb130ce17fc7ab1a048feb84571a01f34411 2024-04-18
FileHash-SHA256 c002e77a1448c0826f3373a10ee2eb130ce17fc7ab1a048feb84571a01f34411 — 2024-04-18
CVE CVE-2023-2640 — 2024-04-18
CVE CVE-2023-32629 — 2024-04-18
FileHash-MD5 0a01080bd0e8989baa4072a3c59dc3a3 MD5 of 9bb260bfec660ffb000760a61ec35e33f1664d87 2024-04-18
FileHash-MD5 3535ff38e651f2ba4691dfbe06f6af66 MD5 of 90df7f9b541d040f2928669914df1665d2756c4c31e736726da28695b012c76e 2024-04-18
FileHash-MD5 4b3577440cc09f38a395d989526fc7ea MD5 of 2af8cf84d16c43cf16d87b1416c27ecf28656bb566eef9a90e56cd2e35171f2e 2024-04-18
FileHash-MD5 55138a70d2c17eb9cbe9d4df19d6cb96 MD5 of e596592ce9b8a8652864f9a4d330729353157351e17fcc66fe5c3af2258ffc04 2024-04-18
FileHash-MD5 6e262c096efc1c149fa5eb7cfc804045 MD5 of 671ec7ec2dafbdcb6b24cbf64263cd4dbf659bef41c575560dda74975ddc4f04 2024-04-18
FileHash-MD5 7d5d924891041d6477bc63bacc42b696 MD5 of d0fc8003a485d66e940b7232685f34e5fc09dc100810acfedcd7707addb64b1b 2024-04-18
FileHash-MD5 8d02db4dad1522baa10f9ca03f224dba MD5 of 26e52d1fc06b80300f2af61e3bb6856c96a2c6d786966bbf1289d2c4b633ce83 2024-04-18
FileHash-MD5 8f48822b3349a925c6101e55bd83acd2 MD5 of a0f50a7b0f9717589000b3414017bdcfcb9d3f6a3e5e03fe49c4dc8035e0d25c 2024-04-18
FileHash-MD5 905c76acbae204ea423a0926ace1b8ac MD5 of 7ad6cc2a67c282b6213a8a5ad2842ba032bb8f25fe6a139f6c01bc8c9e0e9251 2024-04-18
FileHash-MD5 bbbfe95e5e55ec8d90b729f7292bbabb MD5 of 97686c33fee056c6ea7f0ed4cd23e4ab769c71a860d83376eb5b490a226a75a6 2024-04-18
FileHash-MD5 c576b0155333483c088e62c1c2be4e5d MD5 of ebad322fd9bb8b74861fe36131eb1166fb0a8ba24cc0a0f7db62b86bb461d9cf 2024-04-18
FileHash-MD5 c9be56f5efc5fb4802c1d640694dde75 MD5 of 689819cfb0e30bbcd623c007313355bf442361dfda168b818f1a3b453691e19e 2024-04-18
FileHash-MD5 dedf44bc5ae7ed1c2314ade798438a01 MD5 of 40b9f04b02f3764794f8b4fcaa882b15426e3c54e3b9a8ef63efd47964f6ace0 2024-04-18
FileHash-MD5 e928314c724c872e609cb77f66aa2047 MD5 of eed2bce379256c80534894459c5ca2c14d3385c067190d33b5ed767b6fe0105c 2024-04-18
FileHash-MD5 f771506118998d83ee029c74163575ed MD5 of a87c89be3472dc1ba82d24495eed166bc44f97765f8869d7705160f03a44fc64 2024-04-18
FileHash-SHA1 13cf3b3d229298646fd70cb6154715d34c242d6b SHA1 of 40b9f04b02f3764794f8b4fcaa882b15426e3c54e3b9a8ef63efd47964f6ace0 2024-04-18
FileHash-SHA1 3a8df73672b3178d1f1583720e84144dee22c0d8 SHA1 of e596592ce9b8a8652864f9a4d330729353157351e17fcc66fe5c3af2258ffc04 2024-04-18
FileHash-SHA1 4861ab61e56d8afa9185724a2444cd22598736b2 — 2024-04-18
FileHash-SHA1 4f0822354f306a019b0fc8345adeef6bb4502de8 SHA1 of a0f50a7b0f9717589000b3414017bdcfcb9d3f6a3e5e03fe49c4dc8035e0d25c 2024-04-18
FileHash-SHA1 50bf1607953ea79d1546874fce4e7e24868db3c7 SHA1 of 26e52d1fc06b80300f2af61e3bb6856c96a2c6d786966bbf1289d2c4b633ce83 2024-04-18
FileHash-SHA1 7860c0d636df7e966cd54e4b1d7da5ec84c763dc SHA1 of eed2bce379256c80534894459c5ca2c14d3385c067190d33b5ed767b6fe0105c 2024-04-18
FileHash-SHA1 9bb260bfec660ffb000760a61ec35e33f1664d87 — 2024-04-18
FileHash-SHA1 a22febf7e3524a6ffcb444b377c08037b31fe6e5 SHA1 of 97686c33fee056c6ea7f0ed4cd23e4ab769c71a860d83376eb5b490a226a75a6 2024-04-18
FileHash-SHA1 ab36db6b777ec71091ded46741b56661b5c92680 SHA1 of 90df7f9b541d040f2928669914df1665d2756c4c31e736726da28695b012c76e 2024-04-18
FileHash-SHA1 b396b5de3aa5d1802e8986f4ad3a5f10d2378997 SHA1 of 671ec7ec2dafbdcb6b24cbf64263cd4dbf659bef41c575560dda74975ddc4f04 2024-04-18
FileHash-SHA1 b65b46a3e054ad8f583d47f75064b47553a7df44 SHA1 of a87c89be3472dc1ba82d24495eed166bc44f97765f8869d7705160f03a44fc64 2024-04-18
FileHash-SHA1 b6f65f741c3c89a6721a10faf840b83a864370d8 SHA1 of d0fc8003a485d66e940b7232685f34e5fc09dc100810acfedcd7707addb64b1b 2024-04-18
FileHash-SHA1 c2898b309544af5963488c31540d177eea5e9a79 SHA1 of 2af8cf84d16c43cf16d87b1416c27ecf28656bb566eef9a90e56cd2e35171f2e 2024-04-18
FileHash-SHA1 d5f9c69de4d7b5705e557bac75832daa3470e636 SHA1 of 689819cfb0e30bbcd623c007313355bf442361dfda168b818f1a3b453691e19e 2024-04-18
FileHash-SHA1 eddd8d610bbcca352fd49840ac8ce57ae9cf8c06 SHA1 of 7ad6cc2a67c282b6213a8a5ad2842ba032bb8f25fe6a139f6c01bc8c9e0e9251 2024-04-18
FileHash-SHA1 fc6e054d6b8a17fbdcf3bad83a7c4fa7202bbd38 SHA1 of ebad322fd9bb8b74861fe36131eb1166fb0a8ba24cc0a0f7db62b86bb461d9cf 2024-04-18
FileHash-SHA256 26e52d1fc06b80300f2af61e3bb6856c96a2c6d786966bbf1289d2c4b633ce83 — 2024-04-18
FileHash-SHA256 2af8cf84d16c43cf16d87b1416c27ecf28656bb566eef9a90e56cd2e35171f2e — 2024-04-18
FileHash-SHA256 40b9f04b02f3764794f8b4fcaa882b15426e3c54e3b9a8ef63efd47964f6ace0 — 2024-04-18
FileHash-SHA256 671ec7ec2dafbdcb6b24cbf64263cd4dbf659bef41c575560dda74975ddc4f04 — 2024-04-18
FileHash-SHA256 689819cfb0e30bbcd623c007313355bf442361dfda168b818f1a3b453691e19e — 2024-04-18
FileHash-SHA256 7ad6cc2a67c282b6213a8a5ad2842ba032bb8f25fe6a139f6c01bc8c9e0e9251 — 2024-04-18
FileHash-SHA256 90df7f9b541d040f2928669914df1665d2756c4c31e736726da28695b012c76e — 2024-04-18
FileHash-SHA256 97686c33fee056c6ea7f0ed4cd23e4ab769c71a860d83376eb5b490a226a75a6 — 2024-04-18
FileHash-SHA256 a0f50a7b0f9717589000b3414017bdcfcb9d3f6a3e5e03fe49c4dc8035e0d25c — 2024-04-18
FileHash-SHA256 a87c89be3472dc1ba82d24495eed166bc44f97765f8869d7705160f03a44fc64 — 2024-04-18
FileHash-SHA256 d0fc8003a485d66e940b7232685f34e5fc09dc100810acfedcd7707addb64b1b — 2024-04-18
FileHash-SHA256 e596592ce9b8a8652864f9a4d330729353157351e17fcc66fe5c3af2258ffc04 — 2024-04-18
FileHash-SHA256 ebad322fd9bb8b74861fe36131eb1166fb0a8ba24cc0a0f7db62b86bb461d9cf — 2024-04-18
FileHash-SHA256 eed2bce379256c80534894459c5ca2c14d3385c067190d33b5ed767b6fe0105c — 2024-04-18
FileHash-SHA256 ff42428f0fcc346cc56e2b00d4b5c4bd43b55f3465b4ccab0efba9c88f4a1c03 SHA256 of 9bb260bfec660ffb000760a61ec35e33f1664d87 2024-04-18
URL http://www.ascio.com — 2024-04-18
domain snapcraftcontent.com — 2024-04-18
email abuse@ascio.com — 2024-04-18
email abusecomplaints@markmonitor.com — 2024-04-18
email whoisrequest@markmonitor.com — 2024-04-18
hostname canonical-lgw01.cdn.snapcraftcontent.com — 2024-04-18
hostname whois.ascio.com — 2024-04-18
hostname www.ascio.com — 2024-04-18
FileHash-MD5 16408417d89c6804a59879ea1f76aa5c MD5 of 8deb90f11f3596dbbfadeaa05fd5b40567a6d60a 2024-04-18
FileHash-SHA1 8deb90f11f3596dbbfadeaa05fd5b40567a6d60a — 2024-04-18
FileHash-SHA1 c4350ff9b23d454ef43a70125dce4bc1b01b19c8 — 2024-04-18
FileHash-SHA256 b1a9e5be43c028442c07071e202f44f33e3a2df167822c5cfed8f998e01fe169 SHA256 of 8deb90f11f3596dbbfadeaa05fd5b40567a6d60a 2024-04-18
hostname www.collabriascreditcard.life — 2024-04-18
FileHash-MD5 091f51a7a1c3a4504a224cc081ce9cee — 2024-04-18
FileHash-MD5 10f66102da0845d333c4d7babec29de9 MD5 of 03abad346c58d3670d064e5f61595367ef393f0a70ee933c21ad8b45fe37d84b 2024-04-18
FileHash-MD5 2cfc36fcd7fe7c7d02ee0d5824248e3e MD5 of 480a42e823456e5c78348a3f85beec0d02581bbfd255dad5cb208c16862f3995 2024-04-18
FileHash-MD5 3b5074b1b5d032e5620f69f9f700ff0e — 2024-04-18
FileHash-MD5 40adfd923eb82b89d8836ba37a19bca1 — 2024-04-18
FileHash-MD5 4830a2614bb8ce1ce732653c1d0a0868 MD5 of 8569772611abe3f25fe4f5d5422aad894d29705c6f97bc2a7978a1d1c1fe9b82 2024-04-18
FileHash-MD5 65005c9d9ae0f0ebeaf22c210571d482 — 2024-04-18
FileHash-MD5 8f215bc0dc0cbf48ad1e9b2c06d7ea91 MD5 of 06fa856bfc3358df897d5fc6afbe5641ff0422e2 2024-04-18
FileHash-MD5 bd0bf25947d4a37404f0424edf4db9ad — 2024-04-18
FileHash-MD5 cd3ccbd6e4226c52b3f59056b35d4bbe MD5 of f556f38690b8b551ec8215bc38d2d1fc02895acf9ff54f9fa140ae568d296dfe 2024-04-18
FileHash-MD5 ce193452508f1eca2072d1a44dccceab MD5 of 514d739ef92e844a370bc555e0f56381f1301992908aab936038a7a7b65f2472 2024-04-18
FileHash-MD5 ce5f3254611a8c095a3d821d44539877 — 2024-04-18
FileHash-MD5 fb4726d465c5f28b84cd6d14cedd13a7 — 2024-04-18
FileHash-SHA1 00683fb98414fbe79ca5b0bf6c912083b2e8e852 SHA1 of 514d739ef92e844a370bc555e0f56381f1301992908aab936038a7a7b65f2472 2024-04-18
FileHash-SHA1 06fa856bfc3358df897d5fc6afbe5641ff0422e2 — 2024-04-18
FileHash-SHA1 3a616cacddba89ab74e97e3c01efabc5222bee58 SHA1 of 8569772611abe3f25fe4f5d5422aad894d29705c6f97bc2a7978a1d1c1fe9b82 2024-04-18
FileHash-SHA1 95132175fef6f09950fb8567cebaac79139fac02 SHA1 of 03abad346c58d3670d064e5f61595367ef393f0a70ee933c21ad8b45fe37d84b 2024-04-18
FileHash-SHA1 ade488f3052694deb0b0ee75a64988d127ecae6d — 2024-04-18
FileHash-SHA1 da29ceebbacf7183b7f8118528052a1e8a01d96d SHA1 of 480a42e823456e5c78348a3f85beec0d02581bbfd255dad5cb208c16862f3995 2024-04-18
FileHash-SHA1 fd64c5bf3243ccdf61ff85427d366c7f73e65b2d SHA1 of f556f38690b8b551ec8215bc38d2d1fc02895acf9ff54f9fa140ae568d296dfe 2024-04-18
FileHash-SHA256 03abad346c58d3670d064e5f61595367ef393f0a70ee933c21ad8b45fe37d84b — 2024-04-18
FileHash-SHA256 2f775f70ce6fe5ad7ab68b60d7b84095a3423754ba8e92ed741f5c34594db066 SHA256 of 06fa856bfc3358df897d5fc6afbe5641ff0422e2 2024-04-18
FileHash-SHA256 480a42e823456e5c78348a3f85beec0d02581bbfd255dad5cb208c16862f3995 — 2024-04-18
FileHash-SHA256 514d739ef92e844a370bc555e0f56381f1301992908aab936038a7a7b65f2472 — 2024-04-18
FileHash-SHA256 8569772611abe3f25fe4f5d5422aad894d29705c6f97bc2a7978a1d1c1fe9b82 — 2024-04-18
FileHash-SHA256 f556f38690b8b551ec8215bc38d2d1fc02895acf9ff54f9fa140ae568d296dfe — 2024-04-18
hostname note.gnu.property — 2024-04-18
URL http://208.68.237.5 — 2024-04-18
URL https://208.68.237.5 — 2024-04-18
URL https://104.18.190.58 — 2024-04-18
URL http://104.18.190.58 — 2024-04-18
URL https://66.175.222.212 — 2024-04-18
URL http://66.175.222.212 — 2024-04-18
URL https://files.local10.com — 2024-04-23
URL http://files.local10.com — 2024-04-23
References (11)
↗ https://hybrid-analysis.com/sample/ff42428f0fcc346cc56e2b00d4b5c4bd43b55f3465b4ccab0efba9c88f4a1c03/661dec693ba6f76f1b0f856a ↗ https://www.virustotal.com/gui/file/ff42428f0fcc346cc56e2b00d4b5c4bd43b55f3465b4ccab0efba9c88f4a1c03/detection/f-ff42428f0fcc346cc56e2b00d4b5c4bd43b55f3465b4ccab0efba9c88f4a1c03-1713373572 ↗ https://www.virustotal.com/gui/file/ff42428f0fcc346cc56e2b00d4b5c4bd43b55f3465b4ccab0efba9c88f4a1c03/details ↗ https://www.virustotal.com/gui/file/ff42428f0fcc346cc56e2b00d4b5c4bd43b55f3465b4ccab0efba9c88f4a1c03/relations ↗ https://www.virustotal.com/gui/file/ff42428f0fcc346cc56e2b00d4b5c4bd43b55f3465b4ccab0efba9c88f4a1c03/behavior ↗ https://www.virustotal.com/gui/file/b1a9e5be43c028442c07071e202f44f33e3a2df167822c5cfed8f998e01fe169/behavior ↗ https://www.virustotal.com/gui/file/b1a9e5be43c028442c07071e202f44f33e3a2df167822c5cfed8f998e01fe169/relations ↗ https://www.virustotal.com/gui/file/b1a9e5be43c028442c07071e202f44f33e3a2df167822c5cfed8f998e01fe169/details ↗ https://hybrid-analysis.com/sample/b1a9e5be43c028442c07071e202f44f33e3a2df167822c5cfed8f998e01fe169/661dac27782fbd32e806df1d ↗ https://hybrid-analysis.com/sample/2f775f70ce6fe5ad7ab68b60d7b84095a3423754ba8e92ed741f5c34594db066/662069f4da14ed794b09465f ↗ https://www.virustotal.com/graph/embed/g96ed65553dbb48529d42c037