af53d0484c188a97eb6b498cff2ecb80e1e8d2ad525458238bf5de4fcd6a4fa6

Analysis

max time kernel
0s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
08-09-2024 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PrismLauncher-Cracked-develop/launcher/Launcher.in
Size

4KB
MD5

28eea473f96af068fbc412008450be75
SHA1

32f41845852b4beb01d59fcebeb5f7bcc0cb2d4a
SHA256

57c87229ee331cbc471172d9eb07dfdf8c9752b9a76ca1f474058ba9d9aeeccf
SHA512

c0fa0ce10085cbe082f7d46ec9d575c6e3c38635514666d3caf607f14e7fcc940cf77992a5d12f6f941c820eb7cd2862a1c4c758173f65235581c42702cf083f
SSDEEP

96:vOMqGHGX5NPBi/I2xNMiIwliXAQdEG2vS6xEjJ8s52l8Kl5qHAv:vOMqrAQdEG2vS6xAJ8s52l88wO

Score

6^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
1503	zenity

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	zenity

/tmp/PrismLauncher-Cracked-develop/launcher/Launcher.in
/tmp/PrismLauncher-Cracked-develop/launcher/Launcher.in
1⤵
PID:1501

/usr/local/sbin/bash
bash /tmp/PrismLauncher-Cracked-develop/launcher/Launcher.in
1⤵
PID:1501

/usr/local/bin/bash
bash /tmp/PrismLauncher-Cracked-develop/launcher/Launcher.in
1⤵
PID:1501

/usr/sbin/bash
bash /tmp/PrismLauncher-Cracked-develop/launcher/Launcher.in
1⤵
PID:1501

/usr/bin/bash
bash /tmp/PrismLauncher-Cracked-develop/launcher/Launcher.in
1⤵
PID:1501

/sbin/bash
bash /tmp/PrismLauncher-Cracked-develop/launcher/Launcher.in
1⤵
PID:1501

/bin/bash
bash /tmp/PrismLauncher-Cracked-develop/launcher/Launcher.in
1⤵
PID:1501
- /usr/bin/which
  which zenity
  2⤵
  PID:1502
- /usr/bin/zenity
  zenity --error "--text=This program should not be run using sudo or as the root user!\\n"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1503

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads