sedexpMalware
Last reported 2 years ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1014Rootkit
“The /opt/bds_elf is a rootkit, leveraging rc.local as a persistence method.”
- T1037Boot or Logon Initialization Scripts
“T1037 - boot or logon initialization scripts: Init”
- T1037.004RC Scripts
“T1037.004 - boot or logon initialization scripts: run control (RC) scripts”
- T1543.002Systemd Service
“Similarly to Systemd services, SysV scripts must also be enabled.”
- T1546Event Triggered Execution
“T1546 - event triggered execution: udev”
- T1546.016Installer Packages
“T1546.016 - event triggered execution: installer packages”
What the reports say
1 report, newest first · the exact sentence from each-
Linux Detection Engineering - A Sequel on Persistence Mechanisms“Researchers from AON recently discovered a malware called "sedexp" that achieves persistence using Udev rules - a technique rarely seen in the wild - so be sure to check out their research article.”
Indicators in its reports
named in the reports above- conduit[.]infoin 1 report
- 4b825dc642cb6eb9…9288fbee4904in 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.