[Intel]: https://haxrob.net/fastcash-for-linux/

Area

Malware reports

Parent threat

Persistence, Privilege Escalation, Defense Evasion, Impact

Finding

https://haxrob.net/fastcash-for-linux/

Industry reference

attack:T1565.002:Transmitted Data Manipulation
attack:T1055:Process Injection
attack:T1055.009:Proc Memory
attack:T1564.001:Hidden Files and Directories
attack:T1574:Hijack Execution Flow
attack:T1567:Financial Theft
attack:T1027.002:Software Packing
uses:Non-persistentStorage
attack:T1027.013:Encrypted/Encoded File

Malware reference

FastCash
https://github.com/timb-machine/linux-malware/issues/407
https://github.com/timb-machine/linux-malware/issues/312
https://github.com/timb-machine/linux-malware/issues/135
wltm

Actor reference

No response

Component

Linux, Banking

Scenario

Internal specialist services