Malware

Hand of Thief

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

bc command triggers BackConnect daemon called p0stfix serves as a reverse shell with a victim connecting to a particular socket

T1059.006PythonEvidence1

All these features are realized through embedded perl scripts.

Persistence

2 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

To achieve persistence after reboot, the Trojan is suspected to create a configuration file called system-firewall.desktop within the path ~/.config/autostart

T1547.013XDG Autostart EntriesEvidence1

create a configuration file called system-firewall.desktop within the path ~/.config/autostart containing the following setting

Privilege Escalation

3 techniques

T1055Process InjectionEvidence1

The shared object is injected in every process whose name does not contain substring gnome-session, dbus or pulseaudio... The injection is performed with a method similar to the one described on Blackhat 2001 by Shaun Clowes.

T1547Boot or Logon Autostart ExecutionEvidence1

To achieve persistence after reboot, the Trojan is suspected to create a configuration file called system-firewall.desktop within the path ~/.config/autostart

T1547.013XDG Autostart EntriesEvidence1

create a configuration file called system-firewall.desktop within the path ~/.config/autostart containing the following setting

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence1

The dropper is obfuscated with the UPX packer... The readability of almost all character strings is hardened by a XOR encryption with a varying 8-bit key.

T1055Process InjectionEvidence1

T1140Deobfuscate/Decode Files or InformationEvidence1

Then it decrypts the config file appended at the end of the binary... The procedure consists of mapping the binary into the memory and copying a relevant part to a buffer that is decrypted by AES with a 256bit key.

T1497Virtualization/Sandbox EvasionEvidence1

Immediately after start, the Trojan checks if it does not run in a virtualized environment... search for a substring "VBOX" and "VMware"... look for a substring "UML","PowerVM Lx86", "QEMU" or "IBM/S390" in /proc/cpuinfo... check an access to /proc/vz or /proc/bc... The presence of any of these signs leads to an early end of execution.

T1497.001System ChecksEvidence1

The Trojan also exits if the root directory is chrooted... by comparing particular lines in /proc/1/mountinfo and /proc/<getpid()>/mountinfo.

T1622Debugger EvasionEvidence1

Moreover, we observed an anti-monitoring check (no communication if wireshark or tcpdump is running)

Credential Access

2 techniques

T1056Input CaptureEvidence1

The two main capabilities of this Trojan are form-grabbing of Linux-specific browsers... This serves as an initialization of the form-grabbing feature. Supported browsers are Chromium, Chrome and Firefox.

T1056.003Web Portal CaptureEvidence1

The intervention of data submits of the Firefox browser is realized as the redirection of program flow of original libnspr40.so!PR_Write function to a custom implementation hPR_Write_ptr of Trojan

Discovery

3 techniques

T1497Virtualization/Sandbox EvasionEvidence1

T1497.001System ChecksEvidence1

The Trojan also exits if the root directory is chrooted... by comparing particular lines in /proc/1/mountinfo and /proc/<getpid()>/mountinfo.

T1622Debugger EvasionEvidence1

Moreover, we observed an anti-monitoring check (no communication if wireshark or tcpdump is running)

Collection

2 techniques

T1056Input CaptureEvidence1

T1056.003Web Portal CaptureEvidence1

The intervention of data submits of the Firefox browser is realized as the redirection of program flow of original libnspr40.so!PR_Write function to a custom implementation hPR_Write_ptr of Trojan

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

Intercepted data, statistics of bots execution, and command from C&C are all interpreted via a custom communication protocol based on AES encryption with 256bits keys combined with Base64 encoding

T1090ProxyEvidence1

socks executes a proxy via custom implementation of SOCKS5 protocol.

T1105Ingress Tool TransferEvidence1

Another commands with names d_exec and update, and they would try an execution of newly downloaded files from a C&C server.

T1573Encrypted ChannelEvidence1

communication protocol based on AES encryption with 256bits keys combined with Base64 encoding

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

avast blogNews

Jan 6, 2015

Linux DDoS Trojan hiding itself with an embedded rootkit

Linux banking trojan referenced only as historical comparison regarding reuse of open-source rootkit/injection code.

avast blogNews

Aug 27, 2013

Linux Trojan “Hand of Thief” ungloved

Linux trojan focused on desktop compromise. It performs browser form-grabbing against Chromium, Chrome, and Firefox; establishes persistence via ~/.config/autostart/system-firewall.desktop; injects a shared object into processes and browsers; provides backdoor access through reverse shell, bind shell, and SOCKS5 proxy functionality; supports downloading/executing additional files; and includes anti-virtualization and anti-monitoring checks.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Hand of Thief

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

bc command triggers BackConnect daemon called p0stfix serves as a reverse shell with a victim connecting to a particular socket

T1059.006PythonEvidence1

All these features are realized through embedded perl scripts.

Persistence

2 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

To achieve persistence after reboot, the Trojan is suspected to create a configuration file called system-firewall.desktop within the path ~/.config/autostart

T1547.013XDG Autostart EntriesEvidence1

create a configuration file called system-firewall.desktop within the path ~/.config/autostart containing the following setting

Privilege Escalation

3 techniques

T1055Process InjectionEvidence1

T1547Boot or Logon Autostart ExecutionEvidence1

To achieve persistence after reboot, the Trojan is suspected to create a configuration file called system-firewall.desktop within the path ~/.config/autostart

T1547.013XDG Autostart EntriesEvidence1

create a configuration file called system-firewall.desktop within the path ~/.config/autostart containing the following setting

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence1

The dropper is obfuscated with the UPX packer... The readability of almost all character strings is hardened by a XOR encryption with a varying 8-bit key.

T1055Process InjectionEvidence1

T1140Deobfuscate/Decode Files or InformationEvidence1

T1497Virtualization/Sandbox EvasionEvidence1

T1497.001System ChecksEvidence1

The Trojan also exits if the root directory is chrooted... by comparing particular lines in /proc/1/mountinfo and /proc/<getpid()>/mountinfo.

T1622Debugger EvasionEvidence1

Moreover, we observed an anti-monitoring check (no communication if wireshark or tcpdump is running)

Credential Access

2 techniques

T1056Input CaptureEvidence1

T1056.003Web Portal CaptureEvidence1

The intervention of data submits of the Firefox browser is realized as the redirection of program flow of original libnspr40.so!PR_Write function to a custom implementation hPR_Write_ptr of Trojan

Discovery

3 techniques

T1497Virtualization/Sandbox EvasionEvidence1

T1497.001System ChecksEvidence1

The Trojan also exits if the root directory is chrooted... by comparing particular lines in /proc/1/mountinfo and /proc/<getpid()>/mountinfo.

T1622Debugger EvasionEvidence1

Moreover, we observed an anti-monitoring check (no communication if wireshark or tcpdump is running)

Collection

2 techniques

T1056Input CaptureEvidence1

T1056.003Web Portal CaptureEvidence1

The intervention of data submits of the Firefox browser is realized as the redirection of program flow of original libnspr40.so!PR_Write function to a custom implementation hPR_Write_ptr of Trojan

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

Intercepted data, statistics of bots execution, and command from C&C are all interpreted via a custom communication protocol based on AES encryption with 256bits keys combined with Base64 encoding

T1090ProxyEvidence1

socks executes a proxy via custom implementation of SOCKS5 protocol.

T1105Ingress Tool TransferEvidence1

Another commands with names d_exec and update, and they would try an execution of newly downloaded files from a C&C server.

T1573Encrypted ChannelEvidence1

communication protocol based on AES encryption with 256bits keys combined with Base64 encoding

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

avast blogNews

Jan 6, 2015

Linux DDoS Trojan hiding itself with an embedded rootkit

Linux banking trojan referenced only as historical comparison regarding reuse of open-source rootkit/injection code.

avast blogNews

Aug 27, 2013

Linux Trojan “Hand of Thief” ungloved

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.