Fallout in linux, Aug 3 – Aug 9

What we caught this week while monitoring over 163,443,884 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Aug 9 · 36 catches · 3 waves · 3 singles
objectives/anti-staticobjectives/command-and-controlobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+3 46d
k.php linux and 3 siblings biggest campaign ✓ 46 days ago

Multi-stage dropper: webshell, root backdoor, credential exfiltration

account/createurl/external-ip
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 46d
wr.php linux and 2 siblings ✓ 46 days ago

Webshell, root account, C2, evasion

webshell/authaccount/create
objectives/anti-staticobjectives/command-and-controlobjectives/collectionobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+4 46d
k.php linux and 2 siblings ✓ 46 days ago

Root backdoor, C2, data exfil

account/createurl/external-ip
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectivesobjectives/evasion 46d
WSW0 linux ✓ 46 days ago

Dropper downloads and executes remote payloads

delivery/download-executecleanup/remove
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 46d
wr.php linux and 2 siblings ✓ 46 days ago

Webshell, backdoor, root persistence, C2

webshell/authaccount/create
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/processobjectives/command-and-controlobjectives 46d
tplink.sh linux ✓ 46 days ago

Multi-arch malware dropper script

delivery/download-execute
micro-behaviors/communicationsmicro-behaviorsobjectives/supply-chainmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/processobjectives/command-and-controlobjectivesobjectives/evasion 46d
715987f8d34a… linux ✓ 46 days ago

Multi-arch dropper downloads and executes payloads

delivery/download-executecleanup/remove

SATURDAY

Sat Aug 8 · 38 catches · 1 wave · 3 singles
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 46d
wr.php linux and 3 siblings biggest campaign ✓ 46 days ago

Webshell, root account, C2, evasion

webshell/authaccount/create
objectives/anti-staticobjectives/command-and-controlobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+3 46d
k.php linux and 2 siblings ✓ 46 days ago

Root backdoor, C2, obfuscation

account/createurl/external-ip
objectives/command-and-controlwell-knownwell-known/Mcmicro-behaviors/processmicro-behaviorsobjectives/persistenceobjectives/impactobjectives/executionmicro-behaviors/communicationsobjectivesobjectives/evasion+5 47d
install.sh linux ✓ 47 days ago

Cryptojacking malware with evasion and persistence

masquerade/pathindicator-removal/logs
objectives/discoveryobjectives/evasionobjectives/supply-chainmicro-behaviors/communicationsmicro-behaviors/processmicro-behaviors/osobjectives/command-and-controlobjectivesmicro-behaviors/fsmicro-behaviors 47d
gpon.sh linux ✓ 47 days ago

C2 dropper executes remote payload

executable/dangerousexecution/binary-native
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/processobjectives/command-and-controlobjectives 47d
a.sh linux ✓ 47 days ago

Raw IP dropper, multi-arch, hidden tmp

delivery/download-executeexecution/pipe

FRIDAY

Fri Aug 7 · 30 catches · 0 waves · 3 singles
micro-behaviors/fsmicro-behaviorsmicro-behaviors/communicationsmicro-behaviors/processmicro-behaviors/osobjectives/command-and-controlobjectives 47d
huawei linux and 8 siblings biggest campaign ✓ 47 days ago

Multi-arch botnet dropper

delivery/download-executebotnet/iot
micro-behaviors/communicationsmicro-behaviorsobjectives/evasionmicro-behaviors/fsmicro-behaviors/processmicro-behaviors/osobjectives/command-and-controlobjectives 47d
twget.sh linux ✓ 47 days ago

Multi-arch raw-IP dropper

delivery/download-executedelivery/fetch-exec
objectives/anti-staticobjectives/command-and-controlobjectives/discoveryobjectives/executionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+3 48d
wr.php linux ✓ 48 days ago

PHP webshell with root persistence

account/createurl/external-ip
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectivesobjectives/persistence 48d
mac linux ✓ 48 days ago

Downloads and executes remote script

system/superviseddropper/editor-bootstrap

THURSDAY

Thu Aug 6 · 45 catches · 1 wave · 3 singles
objectives/anti-staticobjectives/command-and-controlobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+3 49d
k.php linux and 3 siblings biggest campaign ✓ 49 days ago

Webshell, backdoor, C2, persistence

account/createurl/external-ip
well-knownwell-known/Mcmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives/privilege-escalationmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/processobjectives/command-and-controlobjectives 48d
d.sh linux ✓ 48 days ago

Mirai botnet dropper with C2

delivery/downloadbotnet/iot
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processmicro-behaviors/osobjectivesobjectives/command-and-control 48d
run.sh linux ✓ 48 days ago

Multi-arch dropper with C2 IP

delivery/download-execute
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectives 48d
telnet.sh linux ✓ 48 days ago

Multi-arch dropper from raw IP

delivery/download-execute
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 49d
wr.php linux and 2 siblings ✓ 49 days ago

Webshell, root account, C2, evasion

webshell/authaccount/create

WEDNESDAY

Wed Aug 5 · 52 catches · 3 waves · 3 singles
objectives/anti-staticobjectives/command-and-controlobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+3 49d
k.php linux and 5 siblings biggest campaign ✓ 49 days ago

Multi-stage backdoor with C2 and persistence

account/createurl/external-ip
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 49d
wr.php linux and 4 siblings ✓ 49 days ago

Multi-stage webshell with root persistence

webshell/authaccount/create
micro-behaviors/communicationsmicro-behaviorsobjectives/executionmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectives 49d
lil linux and 2 siblings ✓ 49 days ago

Downloads and executes remote payloads

delivery/download-executedelivery/fetch-exec
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/lateral-movementmicro-behaviors/fsobjectives/command-and-controlobjectivesobjectives/persistence+4 49d
wr.php linux and 2 siblings ✓ 49 days ago

Webshell, root account, C2, evasion

webshell/authaccount/create
micro-behaviors/communicationsmicro-behaviorsobjectives/command-and-controlobjectives/anti-staticobjectives/collectionobjectives/discoveryobjectives/evasionobjectives/impactobjectives/anti-analysisobjectives/persistenceobjectives+6 49d
k.php linux ✓ 49 days ago

Root user creation, C2, webshell

account/createanalysis-bomb/rule-timeout
micro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/discoveryobjectives/evasionobjectives/executionobjectives/impactobjectives/lateral-movementobjectives/command-and-controlobjectivesobjectives/persistence+5 49d
wr.php linux ✓ 49 days ago

Webshell, root account, C2, evasion

webshell/authaccount/create
micro-behaviors/communicationsmicro-behaviorsobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/processobjectives/command-and-controlobjectives 49d
cgi.sh linux ✓ 49 days ago

Multi-arch setuid dropper

delivery/fetch-exec

TUESDAY

Tue Aug 4 · 38 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsobjectives/executionmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectives 51d
p linux and 4 siblings biggest campaign ✓ 51 days ago

Dropper downloads and executes raw IP payloads

delivery/download-executedelivery/fetch-exec
micro-behaviors/fsmicro-behaviorsobjectives/lateral-movementmicro-behaviors/communicationsmicro-behaviors/osmicro-behaviors/processobjectives/command-and-controlobjectives 51d
0x83911d24Fx.sh linux ✓ 51 days ago

Multi-arch raw-IP payload dropper

delivery/fetch-exec
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/processobjectives/command-and-controlobjectives 51d
cgi.sh linux ✓ 51 days ago

Multi-arch dropper fetching and executing remote binaries

delivery/fetch-exec
micro-behaviors/fsmicro-behaviorsobjectives/executionmicro-behaviors/communicationsmicro-behaviors/processobjectivesobjectives/command-and-control 51d
Pandora.sh linux ✓ 51 days ago

Raw IP fetch and execute

delivery/fetch-exec

MONDAY

Mon Aug 3 · 36 catches · 1 wave · 3 singles
objectives/anti-staticobjectives/command-and-controlobjectives/discoveryobjectives/evasionobjectives/lateral-movementmicro-behaviors/fsmicro-behaviors/osmicro-behaviors/communicationsmicro-behaviorsobjectives/persistenceobjectives+3 52d
k.php linux and 2 siblings biggest campaign ✓ 52 days ago

Root backdoor, C2, obfuscation

account/createurl/external-ip
micro-behaviors/communicationsmicro-behaviorsobjectives/evasionmicro-behaviors/fsmicro-behaviors/processobjectives/command-and-controlobjectivesobjectives/impact 52d
0dc71107e396… linux ✓ 52 days ago

Malware dropper with kill loop and C2

rival-bot/competitordelivery/download-execute
micro-behaviors/processmicro-behaviorsobjectives/persistenceobjectives/impactmicro-behaviors/communicationsmicro-behaviors/fsmicro-behaviors/osmetadataobjectives/command-and-controlobjectives 52d
e718fb56f1ab… linux ✓ 52 days ago

Dropper, C2, persistence, miner kill

delivery/download-executeexecution/pipe
micro-behaviors/communicationsmicro-behaviorsobjectives/impactobjectives/persistenceobjectives/discoverymicro-behaviors/fsmicro-behaviors/osmicro-behaviors/processmicro-behaviors/cryptoobjectives/command-and-controlobjectives+2 52d
343d40b06b48… linux ✓ 52 days ago

Cryptojacking dropper with C2 and persistence

delivery/download-executedelivery/download
micro-behaviors/fsmicro-behaviorsmicro-behaviors/communicationsmicro-behaviors/processmicro-behaviors/osobjectives/command-and-controlobjectives 52d
huawei linux and 2 siblings ✓ 52 days ago

IoT botnet dropper script

botnet/iotdelivery/download-execute
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories