Overview

overview

7

Static

static

sigthief.py

ubuntu-18.04-amd64

7

sigthief.py

debian-9-armhf

1

sigthief.py

debian-9-mips

1

sigthief.py

debian-9-mipsel

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sigthief.py

  • Size

    10KB

  • Sample

    221128-cj4llafg38

  • MD5

    3ab332036d3d137c16e7a6307243ba2e

  • SHA1

    16e945f448e877aff61e488d2f5f6fd1ea111ef2

  • SHA256

    3da90e1f2f599849c01dd5e873c0fe902579666556069140e8e89b7476f6fc6a

  • SHA512

    fb596987e3606533b2961550a94e8252da4db36093effaa554d8f1e7e4047fb915204143b16c0a0922295d1badd047fdf0b629f3cd61b56b93b55c83e635b483

  • SSDEEP

    192:Juj5U9+6E0yWYSF/DwI6CRgRIah/gSEU15AkAJi:JvyMvRHU1D

Score
7/10
linux

Malware Config

Targets

    • Target

      sigthief.py

    • Size

      10KB

    • MD5

      3ab332036d3d137c16e7a6307243ba2e

    • SHA1

      16e945f448e877aff61e488d2f5f6fd1ea111ef2

    • SHA256

      3da90e1f2f599849c01dd5e873c0fe902579666556069140e8e89b7476f6fc6a

    • SHA512

      fb596987e3606533b2961550a94e8252da4db36093effaa554d8f1e7e4047fb915204143b16c0a0922295d1badd047fdf0b629f3cd61b56b93b55c83e635b483

    • SSDEEP

      192:Juj5U9+6E0yWYSF/DwI6CRgRIah/gSEU15AkAJi:JvyMvRHU1D

    Score
    7/10

    • Write file to user bin folder

    • Writes file to tmp directory

      Malware often drops required files in the /tmp directory.

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Hijack Execution Flow

1
T1574

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks