General

  • Target

    1560-1-0x0000000008048000-0x0000000008066dc0-memory.dmp

  • Size

    64KB

  • Sample

    240220-wc3khada58

  • MD5

    78f843c208dd3b9e1dd8febccebddb07

  • SHA1

    516ca9ad504ab603d33e1daee8481319af482f8d

  • SHA256

    29794455b91aa37f392787eb8a2e43f64aa90baf4284cab53279c9938d4fe43c

  • SHA512

    e02917e81c2011822978e1c71b33bcc990d7583076567668d3dbb97b6f33be481d0fa1a48c40c50a0c13c3c9965538ad8596ad83660b4f3982a9f6e21c666653

  • SSDEEP

    1536:uWvDicIgqIUNIMVymP6kWHz5zi7e80mW68pyZv5W0olVFSd:RvDMgqIUyMV1BWHtnHXpyZhWdvFU

Score
10/10

Malware Config

Targets

    • Target

      1560-1-0x0000000008048000-0x0000000008066dc0-memory.dmp

    • Size

      64KB

    • MD5

      78f843c208dd3b9e1dd8febccebddb07

    • SHA1

      516ca9ad504ab603d33e1daee8481319af482f8d

    • SHA256

      29794455b91aa37f392787eb8a2e43f64aa90baf4284cab53279c9938d4fe43c

    • SHA512

      e02917e81c2011822978e1c71b33bcc990d7583076567668d3dbb97b6f33be481d0fa1a48c40c50a0c13c3c9965538ad8596ad83660b4f3982a9f6e21c666653

    • SSDEEP

      1536:uWvDicIgqIUNIMVymP6kWHz5zi7e80mW68pyZv5W0olVFSd:RvDMgqIUyMV1BWHtnHXpyZhWdvFU

    Score
    7/10
    • Changes its process name

    • Deletes Audit logs

      Deletes logs related to the Linux Audit framework.

    • Deletes itself

    • Deletes journal logs

      Deletes systemd journal logs. Likely to evade detection.

    • Deletes system logs

      Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

MITRE ATT&CK Enterprise v15

Tasks