SkidmapMalware
Skidmap is a kernel-mode rootkit used for cryptocurrency mining.From MITRE ATT&CK
Last reported 20 months ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1014Rootkit
“This is a common technique, and some examples include the open-source Medusa and Azazel rootkits, and by malwares such as Ebury, and Skidmap to establish persistence, capture credentials, and maintain unauthorized access.”
- T1053Scheduled Task/Job
“…able hunts for each persistence mechanism; however, more details regarding the basics of threat hunting are outlined in the “Hunting for T1053 - scheduled task/job” section of “Linux Detection Engineering - A primer on persistence mechanisms”.”
- T1546Event Triggered Execution
“T1546.016 - Event Triggered Execution: Installer Packages”
- T1546.016Installer Packages
“T1546.016 - Event Triggered Execution: Installer Packages”
- T1556Modify Authentication Process
“T1556.003 - Modify Authentication Process: Pluggable Authentication Modules”
- T1556.003Pluggable Authentication Modules
“T1556.003 - Modify Authentication Process: Pluggable Authentication Modules”
What the reports say
1 report, newest first · the exact sentence from each-
Linux Detection Engineering - Approaching the Summit on Persistence Mechanisms“This is a common technique, and some examples include the open-source Medusa and Azazel rootkits, and by malwares such as Ebury, and Skidmap to establish persistence, capture credentials, and maintain unauthorized access.”
Indicators in its reports
named in the reports above- hxxps://github[.]com/Aegrah/PANIXin 1 report
- 9543f7ce4c6a8def…5a2d3f43383bin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.