TF-MAL-elf.cetus
📛 Threat Title
Malware family: Cetus
Description
ThreatFox malware family `elf.cetus`. Printable name: Cetus.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.cetus
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.cetus
IOC database
- Type
- domain
- Value
elf.cetus- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.cetus
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.cetus
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:arxiv.org
Interpretable models are especially important in ad-versarial domains such as malware analysis, where understanding the rationale behind a classification can guide remediation efforts and enhance model robust-ness. This paper proposes a novel approach for detect-ing and explaining concept drift in malware families over time.
-
web:cybernews.com
The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the Cetus malware family including references, samples and yara signatures.
-
web:support.trellix.com
A new and improved Docker cryptojacking worm known as Cetus was discovered, which installed software to mine for Monero digital currency. The malware tries to disguise itself as the Portainer user interface management tool, which is used to manage multiple Docker environments.
-
web:threats.wiz.io
Cetus is a cryptojacking worm named after a Greek mythology monster that disguises itself as a harmless whale. It masquerades as legitimate binaries commonly used in Docker environments, specifically Portainer, a UI tool for managing multiple Docker instances. The miner deployed by Cetus , XMRig, is disguised as "docker-cache," a plausible yet non-existent binary. Cetus also employs Masscan to ...
-
web:www.boozallen.com
The ability to quickly pin down the family of malware used during a cyber attack can be a massive boon to an incident responder. Not only does family classification provide immediate insights about the characteristics and behaviors of a malware sample, but it is a core part of the triage, remediation , and attribution efforts.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.cyfrin.io
Remediation Containment began with Cetus pausing the affected contracts to stop additional extraction. In parallel, Sui validators coordinated emergency action to block attacker-controlled addresses on-chain, which is what preserved the majority of the stolen value on Sui instead of allowing a full bridge-out.
-
web:www.nature.com
This study proposes a hierarchical deep learning framework for Portable Executable (PE) malware detection and family categorization, underpinned by a novel Doubly Regularized Binary Cross-Entropy ...
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.