71ef590b32ef90a021be7bafd074b7698ffefab7f935e371568bef5eb2543f19 | Triage

Sharing

General

Target

23s
Size

549KB
Sample

220405-phancaeeh3
MD5

b4ff3961cefcc5e151e319666bae6f5e
SHA1

e1e985a90a116edea41d99b3e2a85a697f760d48
SHA256

71ef590b32ef90a021be7bafd074b7698ffefab7f935e371568bef5eb2543f19
SHA512

e4a6eed3bbedf52e8b636ddfa34bde662dd9f8b7fd7745dc7689605b966bf24b0ed76bf9e418dab5d32668b9b6ecdc09b0e5da8cd011a274d8186cc169f4d52e

Score

9^/10

linux persistence

Malware Config

Targets

- Target
  
  23s
- Size
  
  549KB
- MD5
  
  b4ff3961cefcc5e151e319666bae6f5e
- SHA1
  
  e1e985a90a116edea41d99b3e2a85a697f760d48
- SHA256
  
  71ef590b32ef90a021be7bafd074b7698ffefab7f935e371568bef5eb2543f19
- SHA512
  
  e4a6eed3bbedf52e8b636ddfa34bde662dd9f8b7fd7745dc7689605b966bf24b0ed76bf9e418dab5d32668b9b6ecdc09b0e5da8cd011a274d8186cc169f4d52e
Score

9^/10

persistence
- Writes file to system bin folder
- Modifies rc script
  Adding/modifying system rc scripts is a common persistence mechanism.
  persistence
- Writes file to tmp directory
  Malware often drops required files in the /tmp directory.
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Hijack Execution Flow

Privilege Escalation

Boot or Logon Autostart Execution

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1