DISGOMOJIMalware
Last reported 2 years ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 21 · each with the sentence it comes from- T1053Scheduled Task/Job
“T1053 - scheduled task/job”
- T1053.002At
“T1053.002 - scheduled task/job: at”
- T1053.003Cron
“T1053.003 - scheduled task/job: Cron”
- T1053.005Scheduled Task
“The scheduled task is called a cron job and can be executed with both user and root permissions, depending on the configuration.”
- T1053.006Systemd Timers
“T1053.006 - scheduled task/job: systemd timers”
- T1059Command and Scripting Interpreter
“T1059.004 - command and scripting interpreter: bind shells”
What the reports say
1 report, newest first · the exact sentence from each-
Linux Detection Engineering - A primer on persistence mechanisms“Volexity recently published research on DISGOMOJI malware, which was found to establish persistence by dropping a .desktop file in the ~/.config/autostart/ directory, which would execute a malicious backdoor planted on the system.”
Indicators in its reports
named in the reports above- multi-user[.]targetin 1 report
- timers[.]targetin 1 report
- default[.]targetin 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.