virlabs.ai · Published 25 Sep
Tracing SIXZUT and JITTERLY in the wild
Excerpt
Tracing SIXZUT and JITTERLY in the wild | VirLabs
On September 13, Acronis published an investigation into Red Heron, an actor exploiting vulnerable Gitea servers. Alongside the campaign, they documented a Linux implant named JITTERLY and its companion rootkit, SIXZUT. Digging around, I found additional public samples and used our platform to analyze them. VirLabs adds a populated rootkit configuration, additional endpoints, and a particularly interesting connection to compromises reported by HestiaCP administrators several months earlier.
The SIXZUT sample I found is configured to conceal and relaunch two agents, __hesti and __root . Both installation paths appear in the HestiaCP f…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by virlabs.ai on virlabs.ai.
Mentioned in the excerpt4
On the same topics
papers.lisdex.sh · PDF · Added 31 Oct
Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain
Hermes is a commercial Windows malware platform that combines credential theft with interactive remote access. Advertisements on Russian-language cybercrime forums offer tiered subscriptions. The service has an operator web panel, worker accounts and a…
papers.lisdex.sh · PDF · Added 31 Oct
Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain
A Python repository advertised as an asynchronous scraper concealed a Windows malware loader in its import path. Following that loader led to Hermes, a subscription service combining credential collection, file access and interactive control of visible and…
K7 Labs · Web page · Published 21 Mar
Volume II: Who aM I? Confessions of an Obfuscated JS Worm
This is volume II of a three part series based on our (Kaarthik RM and Rajababu A) paper for AVAR 2013, discussing the prevalence of autorun malware in the Asian region, taking it further by analyzing an example of such a malware Carrying on from where we…
Elastic Security Labs · Web page · Published 26 Mar
The Shelby Strategy
The SHELBY malware family abuses GitHub for command-and-control, stealing data and retrieving commands The attacker’s C2 design has a critical flaw: anyone with the PAT token can control infected machines, exposing a significant security vulnerability Unused…