TF-MAL-elf.vermilion_strike
📛 Threat Title
Malware family: Vermilion Strike
Description
ThreatFox malware family `elf.vermilion_strike`. Printable name: Vermilion Strike.
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:archive.orkl.eu
In August 2021, we at Intezer discovered a fully undetected ELF implementation of Cobalt Strike's beacon, which we named Vermilion Strike . The stealthy sample uses Cobalt Strike's Command and Control (C2) protocol when communicating to the C2 server and has Remote Access capabilities such as uploading files, running shell commands and writing to files. The malware is fully undetected in ...
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family . The page below gives you an overview on malware samples that MalwareBazaar has identified as VermilionStrike .
-
web:intezer.com
Vermilion Strike is a stealthy re-implementation of Cobalt Strike Beacon for Windows and Linux. Linux malware is fully undetected.
-
web:live.paloaltonetworks.com
How to detect and prevent the Cobalt Strike attack in the wild, and provide the IoC and mitigation suggestions.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the Vermilion Strike malware family including references, samples and yara signatures.
-
web:www.anavem.com
KB890830 delivers the March 2026 update for Windows Malicious Software Removal Tool (MSRT), adding detection and removal capabilities for 47 new malware families including advanced ransomware variants and AI-powered threats targeting Windows 10, Windows 11, and Windows Server systems.
-
web:www.anomali.com
Vermilion Strike : Linux and Windows Re-implementation of Cobalt Strike (published: September 13, 2021) Researchers at Intezer have discovered an undetected ELF Cobalt Strike beacon. First found in August 2021, the beacon named Vermillion Strike shares infrastructure and functionality with Windows Cobalt Strike , and is a reimplementation for Linux.
-
web:www.curatedintel.org
Vermilion Strike is a fully undetected ELF variant of Cobalt Strike's Beacon. The malware was discovered by Intezer and was first uploaded to VirusTotal from a user in Malaysia.
-
web:www.redpacketsecurity.com
Upon installing the sample, the malware will run in the background using daemon and decrypt the configuration necessary for the beacon to function. The malware connects C2 primarily over DNS, to avoid detection, but it is also able to use HTTP. " Vermilion Strike and other Linux threats remain a constant threat.
-
web:www.securityweek.com
Security researchers with Intezer have identified a reimplementation of the infamous Cobalt Strike Beacon payload, which features completely new code. Dubbed Vermilion Strike , the malware can be used to target Linux and Windows devices and provides attackers with remote access capabilities such as file manipulation and shell command execution.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.