Malware.View on attack.mitre.org
Skidmap is a kernel-mode rootkit used for cryptocurrency mining.
| Technique | Procedure example |
|---|---|
| T1014 Rootkit |
Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low. |
| T1027.013 Encrypted/Encoded File |
Skidmap has encrypted it's main payload using 3DES. |
| T1036.005 Match Legitimate Resource Name or Location |
Skidmap has created a fake |
| T1053.003 Cron |
Skidmap has installed itself via crontab. |
| T1057 Process Discovery |
Skidmap has monitored critical processes to ensure resiliency. |
| T1059.004 Unix Shell |
Skidmap has used |
| T1082 System Information Discovery |
Skidmap has the ability to check whether the infected system’s OS is Debian or RHEL/CentOS to determine which cryptocurrency miner it should use. |
| T1083 File and Directory Discovery |
Skidmap has checked for the existence of specific files including |
| T1098.004 SSH Authorized Keys |
Skidmap has the ability to add the public key of its handlers to the |
| T1105 Ingress Tool Transfer |
Skidmap has the ability to download files on an infected host. |
| T1140 Deobfuscate/Decode Files or Information |
Skidmap has the ability to download, unpack, and decrypt tar.gz files . |
| T1496.001 Compute Hijacking |
Skidmap is a kernel-mode rootkit used for cryptocurrency mining. |
| T1518.001 Security Software Discovery |
Skidmap has the ability to check if |
| T1547.006 Kernel Modules and Extensions |
Skidmap has the ability to install several loadable kernel modules (LKMs) on infected machines. |
| T1556.003 Pluggable Authentication Modules |
Skidmap has the ability to replace the pam_unix.so file on an infected machine with its own malicious version that accepts a specific backdoor password for all users. |
None recorded.
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
