Fallout in linux, Jul 27 – Aug 2

What we caught this week while monitoring over 167,389,056 artifacts across 46 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Aug 2 · 38 catches · 1 wave · 3 singles
micro-behaviors/fsmicro-behaviorsmicro-behaviors/communicationsmicro-behaviors/processmicro-behaviors/osobjectives/command-and-controlobjectives 54d
sensi_hk.sh linux and 5 siblings biggest campaign ✓ 54 days ago

IoT botnet dropper script

botnet/iotdelivery/download-execute
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 54d
wr.php linux and 2 siblings ✓ 54 days ago

Webshell, root account, C2, evasion

webshell/authaccount/create
micro-behaviors/communicationsmicro-behaviorsobjectives/supply-chainmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectivesobjectives/evasion 54d
WSW0 linux ✓ 54 days ago

Downloads and executes remote payloads

delivery/execute-downloadcleanup/remove
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectivesobjectives/command-and-controlobjectives/evasion 54d
WSW0 linux ✓ 54 days ago

Dropper downloads and executes remote payloads

delivery/download-executecleanup/remove
objectives/command-and-controlobjectives/anti-staticobjectives/collectionobjectives/discoveryobjectives/evasionobjectives/impactobjectives/lateral-movementmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+5 54d
k.php linux ✓ 54 days ago

Root backdoor, C2, data exfil

account/createurl/external-ip

SATURDAY

Sat Aug 1 · 53 catches · 3 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/credential-accessobjectives/discoveryobjectives/persistenceobjectives/executionobjectives/supply-chainobjectives/command-and-controlobjectivesobjectives/exfiltration+5 55d
k.php linux and 6 siblings biggest campaign ✓ 55 days ago

FreePBX webshell backdoor

webshell/stagerstealer/file
micro-behaviors/fsmicro-behaviorsobjectives/evasionobjectives/executionmicro-behaviors/communicationsmicro-behaviors/osmicro-behaviors/processobjectives/command-and-controlobjectives 55d
1.sh linux ✓ 55 days ago

Multi-arch raw-IP malware dropper

delivery/fetch-exec
objectives/command-and-controlobjectives/anti-staticobjectives/collectionobjectives/discoveryobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+3 55d
k.php linux and 4 siblings ✓ 55 days ago

Malicious backdoor with root account creation

account/createurl/external-ip
objectives/command-and-controlobjectives/anti-staticobjectives/collectionobjectives/discoveryobjectives/exfiltrationobjectives/lateral-movementobjectives/supply-chainmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+5 55d
k.php linux and 2 siblings ✓ 55 days ago

Malicious script with backdoors and data exfiltration

account/createurl/external-ip
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/persistenceobjectives/credential-accessobjectives/supply-chainmicro-behaviors/fsmicro-behaviors/osobjectives/command-and-controlobjectives+3 55d
wr.php linux and 2 siblings ✓ 55 days ago

Webshell, C2, root persistence

webshell/stagerwebshell/auth
objectives/command-and-controlobjectives/anti-staticobjectives/collectionobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+4 55d
k.php linux ✓ 55 days ago

Root backdoor, C2, data exfil

account/createurl/external-ip

WEDNESDAY

Wed Jul 29 · 15 catches · 0 waves · 3 singles
objectives/evasionobjectiveswell-known/Mcmetadatametadata/buildwell-known/libmicro-behaviors/osmetadata/hardeningmicro-behaviors/fsmicro-behaviorswell-known 58d
6284528c4a3b… linux 58 days ago

Mirai botnet malware variant

mirai/coredevice/special
objectivesobjectives/impactwell-known/Mcmetadatametadata/buildobjectives/evasionwell-known/libmicro-behaviors/communicationsmicro-behaviors/fsmicro-behaviorswell-known+1 58d
64634ceeffb1… linux 58 days ago

Mirai botnet malware binary

mirai/coredevice/special
objectivesobjectives/command-and-controlwell-known/Mcmetadatametadata/archobjectives/evasionobjectives/anti-staticobjectives/impactmicro-behaviors/fsmicro-behaviorswell-known+4 58d
663606a57b1f… linux 58 days ago

Mirai botnet malware variant

mirai/coredevice/special

TUESDAY

Tue Jul 28 · 70 catches · 9 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/executionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osobjectives/command-and-controlobjectivesobjectives/persistence+3 59d
wr.php linux and 3 siblings biggest campaign ✓ 59 days ago

Webshell backdoor with root persistence

webshell/authaccount/create
objectives/command-and-controlobjectives/anti-staticobjectives/collectionobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+4 59d
k.php linux and 2 siblings ✓ 59 days ago

Malicious backdoor with root account creation

account/createurl/external-ip
objectivesobjectives/command-and-controlmicro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/process 59d
c7b5d9d4b408… linux ✓ 59 days ago

Malware dropper killing processes and downloading payloads

micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectives 59d
6f37cefbb1e7… linux ✓ 59 days ago

Malicious dropper downloading and executing payloads

delivery/download-execute
objectivesobjectives/collectionmicro-behaviorsmicro-behaviors/communicationsobjectives/supply-chainmicro-behaviors/fs 59d
54724e7230d7… linux ✓ 59 days ago

Installs SSH backdoor via raw IP

objectives/command-and-controlobjectives/anti-staticobjectives/collectionobjectives/discoveryobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+3 59d
k.php linux and 2 siblings ✓ 59 days ago

Malicious shell script with backdoors and exfiltration

account/createurl/external-ip
objectives/anti-staticobjectives/command-and-controlobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+3 59d
k.php linux and 2 siblings ✓ 59 days ago

Root backdoor, C2, obfuscation

account/createurl/external-ip
objectives/command-and-controlobjectives/anti-staticobjectives/collectionobjectives/discoveryobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+3 59d
k.php linux and 2 siblings ✓ 59 days ago

Malicious backdoor with root persistence

account/createurl/external-ip
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectives 59d
543ee6bb14d7… linux and 2 siblings ✓ 59 days ago

Malicious dropper downloading and executing payloads

delivery/download-execute
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectivesobjectives/impact 59d
lil linux and 2 siblings ✓ 59 days ago

Malware kill loop and dropper

rival-bot/competitordelivery/download-execute
objectives/command-and-controlobjectives/anti-staticobjectives/collectionobjectives/discoveryobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+3 59d
k.php linux and 2 siblings ✓ 59 days ago

Malicious backdoor with root persistence

account/createurl/external-ip
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 59d
wr.php linux and 2 siblings ✓ 59 days ago

Webshell, root account, C2, evasion

webshell/authaccount/create
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/persistenceobjectives/credential-accessobjectives/supply-chainmicro-behaviors/fsmicro-behaviors/osobjectives/command-and-controlobjectives+3 59d
wr.php linux and 2 siblings ✓ 59 days ago

Webshell, C2, root persistence

webshell/stagerwebshell/auth
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories