TF-MAL-elf.blackrota
📛 Threat Title
Malware family: Blackrota
Description
ThreatFox malware family `elf.blackrota`. Printable name: Blackrota.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.blackrota
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.blackrota
IOC database
- Type
- domain
- Value
elf.blackrota- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.blackrota
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.blackrota
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:bazaar.abuse.ch
Malware samples associated with tag Blackrota MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with Blackrota . Database Entry
-
web:blog.netlab.360.com
The most obfuscated Go-developed ELF-formatted malware we've found to date. Overview Recently, a malicious backdoor program written in the Go language that exploits an unauthorized access vulnerability in the Docker Remote API was caught by the our Anglerfish honeypot. We named it Blackrota , given that its C2 domain name is
-
web:cybersecuritynews.com
Two sophisticated Linux rootkits are posing increasingly serious threats to network security by exploiting eBPF technology to hide their presence from traditional detection systems. BPFDoor and Symbiote, both originating from 2021, represent a dangerous class of malware that combines advanced kernel-level access with powerful evasion capabilities.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the Blackrota malware family including references, samples and yara signatures.
-
web:tech-en.netlify.app
The obfuscation technique used in the Blackrota and EKANS malware creates new calls / problems for disassembly. As the Go language becomes more popular and more and more malware is written in Go in the future, we'll keep an eye on what happens.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.fortinet.com
FortiGuard Labs discovered new Symbiote and BPFDoor variants exploiting eBPF filters to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert C2 communication.
-
web:www.microsoft.com
Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.
-
web:www.pcrisk.com
Like with Blackrota the malware is written in Go and makes use of several libraries that set up communication between the infected container and the attackers command-and-control server monitor systems and processes; and establish a disk-backed key-value storage area to hold data.
-
web:www.researchgate.net
Prevention and detection of eBPF-based malware is also explored, with the goal of providing organizations or legitimate users of eBPF techniques to harden their systems against eBPF-based malware ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.