General
- Target lh.sh
- Size 11KB
- Sample220326-3daz7sehcq
- SHA256 a58fa03638110727f4a4a227f6ec2c0dceaeb39ccee89d12a4d727bb50d29dc0
Score
10/10
Malware Config
Targets
-
- Target lh.sh
- Size 11KB
- SHA256 a58fa03638110727f4a4a227f6ec2c0dceaeb39ccee89d12a4d727bb50d29dc0
Score10/10-
suricata: ET MALWARE ELF/Kinsing Payload Request M1
suricata: ET MALWARE ELF/Kinsing Payload Request M1
-
Modifies hosts file
Adds to hosts file used for mapping hosts to IP addresses.
-
Writes DNS configuration
Writes data to DNS resolver config file.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Write file to user bin folder
-
Legitimate hosting services abused for malware hosting/C2
-
Reads CPU attributes
-
Enumerates kernel/hardware configuration
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory
Malware often drops required files in the /tmp directory.