Transparent Tribe DISGOMOJI Targeting Linux

MITRE Techniques

• [T1566] Phishing – Inducing users to execute a file named “Password” inside a zipped archive to initiate infection (“users are induced to execute a file named password … that displays a decoy document password while downloading subsequent components”).
• [T1543] Create or Modify System Process – Modifying the .bashrc file and scheduling cron jobs for persistence (“writing configuration commands to ‘.bashrc’ and adding a cron job to ensure execution”).
• [T1105] Ingress Tool Transfer – Downloading subsequent payloads from Google Drive URLs (“downloading ‘x96coreinfo’, ‘ec’, and other files from specific Google Drive public addresses”).
• [T1027] Obfuscated Files or Information – Use of encrypted intermediate files and multiple layers of encryption with RC4 and AES (“’ec’ file used to decrypt ‘intermediate’ and ‘x96coreinfo’ using RC4 and AES algorithms”).
• [T1059] Command and Scripting Interpreter – Execution of Java JAR files and shell scripts to facilitate payload deployment (“executing ‘x96-dependencies.jar’ with ‘java -jar’ command and shell scripts for downloading and launching malware”).
• [T1083] File and Directory Discovery – Collecting files with specific extensions from the working directory for exfiltration (“stealing files with extensions such as .doc, .pdf, .xls, .jpg from the current working directory”).
• [T1113] Screen Capture – Implicitly suggested via browser monitoring to steal session cookies and user UUIDs (“monitoring visits to sites like https://email.gov.in and stealing cookies and uuid”).
• [T1021] Remote Services – Installing MeshAgent remote management tool for ongoing control (“installing MeshAgent via script hosted on remote domain”).