Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started
Malware PITHOOK

PITHOOK

TLP:CLEAR
Family
Hunt Package

AI Analysis

No AI analysis yet.

Description

According to Mandiant, PITHOOK hooks the accept and accept4 functions within the web process by modifying the PLT. When PITHOOK receives a buffer matching the predefined magic byte sequence, it will duplicate the socket and forward it to PITSTOP over the Unix domain socket /data/runtime/cockpit/wd.fd.

Details

Type
Unknown
Platforms
Linux
Confidence
80%
Notes
0
Log in to add a note
No notes yet. Click "Add Note" to create the first analysis note.
Opinions
0
Log in to add an opinion
No opinions yet. Be the first to assess this intelligence.
Leaving Threaticon

This link opens an external site that isn't part of the platform.