MalwareHunterTeam analyzed a low-detection Linux ELF backdoor named gregbfdah.png that was delivered from an AWS S3 URL and uploaded to VirusTotal in June 2026. The implant uses AES-128-GCM and MessagePack for configuration and C2 communication, and it supports registration, command execution, file operations, and reverse pivot tunneling. #MalwareHunterTeam #gregbfdah.png #VirusTotal #iot.981666.xyz
Keypoints
- The sample is a statically linked x86-64 Linux ELF backdoor/C2 implant written in C++.
- It was delivered from
https://zapier-logos.s3.amazonaws[.]com/gregbfdah.pngand first submitted to VirusTotal from India on 2026-06-11. - The file was uploaded to VirusTotal on 2026-06-16 and still had very low detection in early July 2026.
- The implant uses MessagePack and AES-128-GCM to store and decrypt configuration data and to encrypt registration and command traffic.
- It generates a host fingerprint from machine ID, username, MAC address, and other static strings, then builds a registration beacon with system profiling data.
- The command set includes process and file management, directory control, program execution, timestomping, job handling, and reverse port forwarding/pivot tunneling.
- The malware appears intended for targeted intrusion, with capabilities useful for persistence, lateral movement, and file exfiltration.
MITRE Techniques
- [T1611 ] Escape to Host – The implant checks whether it is running as root by comparing the UID to 0, which helps it understand privilege level (‘Validates if it is running as root by comparing the uid to 0.’)
- [T1543.002 ] Create or Modify System Process: Systemd Service – The malware uses a classic double fork for daemonization and redirects standard streams to /dev/null to run as a background service (‘Implements a classic double fork for daemonization.’ / ‘Redirects its standard streams to /dev/null.’)
- [T1071.001 ] Application Layer Protocol: Web Protocols – It communicates with infrastructure hosted on AWS S3 and registers to a C2 over network-based beaconing (‘The file was delivered from the following AWS domain…’ / ‘builds a beacon to register to the C2’)
- [T1027 ] Obfuscated Files or Information – The configuration is encrypted with AES-128-GCM and later decrypted before use, hiding operational details (‘The configuration is embedded in the .data section and is encrypted with AES-128 in GCM mode.’)
- [T1041 ] Exfiltration Over C2 Channel – The implant supports file exfiltration and sends registration data to the C2 using encrypted MessagePack structures (‘File exfiltration Allows for exfiltration of larger files. Chunked uploads’ / ‘The registration beacon … is encrypted’)
- [T1105 ] Ingress Tool Transfer – It can write delivered files to disk and unzip them, indicating staged payload delivery (‘Writes files to disk It can unzip delivered files’)
- [T1057 ] Process Discovery – The implant enumerates running processes via a command mapped to ps aux (‘Process listing Equivalent to ps aux’)
- [T1083 ] File and Directory Discovery – It lists directories and enumerates the root directory, similar to ls -la and / enumeration (‘Directory Listing Equivalent to ls -la’ / ‘Root directory enumeration’)
- [T1106 ] Native API – The malware uses Linux system calls such as getcwd, chdir, mkdir, kill, chmod, and utimensat to perform actions (‘Uses getcwd syscall’ / ‘Uses chdir syscall’ / ‘Uses mkdir syscall’ / ‘Uses kill system call’ / ‘uses utimensat syscall’)
- [T1053.003 ] Scheduled Task/Job: Cron – It includes job listing and cancellation features for asynchronously executed tasks (‘Lists tasks run asynchronously’ / ‘Cancels a job by ID’)
- [T1569.002 ] System Services: Service Execution – It can execute programs, including via PTY for interactive use (‘Executes program with arguments’ / ‘Program Execution with a PTY’)
- [T1090.001 ] Proxy: Internal Proxy – The implant supports reverse port forwarding and pivot tunneling to relay traffic (‘Reverse Port forward/Pivot Tunnel’)
- [T1090.003 ] Proxy: Multi-hop Proxy – It can connect to a peer implant and relay data through an existing tunnel, enabling pivoting (‘Connects to malware relay (a peer)’ / ‘Sends Data Through Pivot’)
Indicators of Compromise
- [URL] delivery source and first-submitted download path –
https://zapier-logos.s3.amazonaws[.]com/gregbfdah.png - [Domain and port] C2 server –
iot.981666[.]xyz:8080 - [File name] delivered ELF sample / masqueraded filename –
gregbfdah.png - [File hash] ELF sample hash –
f264f04f597a2bdda372a27ae701c18d4036175b1eb8722db5f8531615b38788
Read more: https://dmpdump.github.io/posts/Unattributed_Linux_Implant/