Unpacking the Diicot Malware Targeting Linux Environments | Wiz Blog
Tags
country: Romania
attack-pattern: Data Direct Credentials - T1589.001 Cron - T1053.003 Domains - T1583.001 Domains - T1584.001 Ip Addresses - T1590.005 Malware - T1587.001 Malware - T1588.001 Password Guessing - T1110.001 Resource Hijacking - T1496 Server - T1583.004 Server - T1584.004 Software Packing - T1027.002 Ssh - T1021.004 Web Protocols - T1071.001 Brute Force - T1110 Exfiltration Over Command And Control Channel - T1041
Show in Graph
Common Information
Type Value
UUID 11795744-2b7a-485d-a7f6-ad3fc6fb8a04
Fingerprint be8fb993a5370701
Analysis status DONE
Considered CTI value 2
Text language
Published Dec. 17, 2024, 12:31 p.m.
Added to db Dec. 17, 2024, 7:35 p.m.
Last updated Dec. 23, 2024, 2:08 p.m.
Headline Unpacking Diicot - Evolving Campaign Targeting Linux Environments
Title Unpacking the Diicot Malware Targeting Linux Environments | Wiz Blog
Detected Hints/Tags/Attributes 70/2/26
Source URLs
Redirection Url
Details Source https://www.wiz.io/blog/diicot-threat-group-malware-campaign
URL Provider
Details Provider Source level domain
Details wiz.io www.wiz.io
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 398 ✔ Wiz Blog | RSS feed https://www.wiz.io/blog/rss 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details sha1 2 
970b45be172ffb9d3192a8d2d015b1c91b216107
Details sha1 2 
1d56f998bc4f7b649f882a2d730d5e9b1b2e621f
Details sha1 2 
f82b2df5e01abab70085a12388b3ec83c5e33ba1
Details sha1 2 
e0e3456a0b3c06a33cbb4db1f7d1335b777cf107
Details IPv4 2 
87.120.114.219
Details IPv4 2 
87.120.116.35
Details IPv4 2 
80.76.51.5
Details IPv4 2 
91.92.250.6
Details MITRE ATT&CK Techniques 166 
T1027.002
Details MITRE ATT&CK Techniques 47 
T1053.003
Details MITRE ATT&CK Techniques 479 
T1071.001
Details MITRE ATT&CK Techniques 458 
T1041
Details MITRE ATT&CK Techniques 47 
T1110.001
Details MITRE ATT&CK Techniques 2 
T1496.001
Details Url 2 
http://80.76.51.5/.nzjjoty
Details Domain 2 
pauza.digitaldatainsights.org
Details Domain 2 
digital.digitaldatainsights.org
Details Domain 2 
test.digitaldatainsights.org
Details File 170 
config.json
Details sha1 2 
a2101ec53fb0934b23f83c582d3a0bed9f66fd13
Details sha1 2 
2ec6af460feabfe9ed37c1955ff266cff63f31ff
Details sha1 2 
7940c6e29ab9cf6abe5e570f73eed93265962e1a
Details sha1 2 
f657f695faf2cfd9f6f2188d154f7767da248b9e
Details sha1 2 
a8a5d0223519590bb48e0b52102786623ec45511
Details sha1 2 
7ece24f3b426169d720ab8353e07f0feb6dbc854
Details sha1 2 
07f200ad0b5a03433a184b442dcd7a688e1ff7a7