Malware.View on attack.mitre.org
AcidPour is a variant of AcidRain designed to impact a wider range of x86 architecture Linux devices. AcidPour is an x86 ELF binary that expands on the targeted devices and locations in AcidRain by including items such as Unsorted Block Image (UBI), Deice Mapper (DM), and various flash memory references. Based on this expanded targeting, AcidPour can impact a variety of device types including IoT, networking, and ICS embedded device types. AcidPour is a wiping payload associated with the Sandworm Team threat actor, and potentially linked to attacks against Ukrainian internet service providers (ISPs) in 2023.
| Technique | Procedure example |
|---|---|
| T1070.004 File Deletion |
AcidPour includes a self-delete function where the malware deletes itself from disk after execution and program load into memory. |
| T1082 System Information Discovery |
AcidPour can identify various system locations and mapped devices on Linux systems as a precursor to wiping activity. |
| T1083 File and Directory Discovery |
AcidPour can identify specific files and directories within the Linux operating system corresponding with storage devices for follow-on wiping activity, similar to AcidRain. |
| T1120 Peripheral Device Discovery |
AcidPour includes functionality to identify MMC and SD cards connected to the victim device. |
| T1485 Data Destruction |
AcidPour can perform an in-depth wipe of victim filesystems and attached storage devices through either data overwrite or calling various IOCTLS to erase them, similar to AcidRain. |
| T1529 System Shutdown/Reboot |
AcidPour includes functionality to reboot the victim system following wiping actions, similar to AcidRain. |
| T1561.001 Disk Content Wipe |
AcidPour includes functionality to overwrite victim devices with the content of a buffer to wipe disk content. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
