cc6ed95cfdf33fc88e8a1de7dc8b1ecadd1af196e5e9d26f0b277deada2b01c4

Target

run.sh
Size

404B
Sample

240626-khaacsyckr
MD5

c3ab72c96f79d89cf768144d9d98070f
SHA1

ff6426eac260f84825fdc938afdb2302734ed754
SHA256

cc6ed95cfdf33fc88e8a1de7dc8b1ecadd1af196e5e9d26f0b277deada2b01c4
SHA512

98a9b5dd77ddba6975426e2c13d97850a8eb4f2e3b95e53cb35fe64ed69caf75ca18b31592fc8e4c84efa16653764ca902f7c301fe58613272c82ed969e45802

Score

7^/10

Malware Config

Targets

- Target
  
  run.sh
- Size
  
  404B
- MD5
  
  c3ab72c96f79d89cf768144d9d98070f
- SHA1
  
  ff6426eac260f84825fdc938afdb2302734ed754
- SHA256
  
  cc6ed95cfdf33fc88e8a1de7dc8b1ecadd1af196e5e9d26f0b277deada2b01c4
- SHA512
  
  98a9b5dd77ddba6975426e2c13d97850a8eb4f2e3b95e53cb35fe64ed69caf75ca18b31592fc8e4c84efa16653764ca902f7c301fe58613272c82ed969e45802
Score

7^/10

antivm evasion upx execution
- Executes dropped EXE
- File Permission
  Adversaries may modify file permissions/attributes to evade access control lists (ACLs) and access protected files.
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Reads MAC address of network interface
  Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
  evasion
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
behavioral1 behavioral10 behavioral11 behavioral12 behavioral13 behavioral14 behavioral15 behavioral16 behavioral17 behavioral18 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Executes dropped EXE

File Permission

UPX packed file

Checks hardware identifiers (DMI)

Reads MAC address of network interface

Reads hardware information

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18