8d3cbb361ad830c50f9e46fe912cd04b2c9d1ca571124e7ff4c59c30a6865aa5

Analysis

max time kernel
0s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/10/2024, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

packages/dmg/script/create.sh
Size

552B
MD5

9bbfc98a75fe99fb00b2c13615acc0a0
SHA1

148ccc48b2466ed8ea1b9d74f3bc7f200b3ba159
SHA256

9353a55c87f87b799a0c7c31c0cee3d0aa38afab9a71bc414d0da23936085494
SHA512

23e41eaa3864d289254fd1a5fffc6036404b5faf6283afaf4d213464bf3227d1532b2273a9cb7066bb0e8447c468bc401043ebc47355c7b18978d4ff872ccb90

Score

6^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
695	sudo

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/stat	sudo

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
693	create.sh

/tmp/packages/dmg/script/create.sh
/tmp/packages/dmg/script/create.sh
1⤵
- System Network Configuration Discovery
PID:693
- /usr/bin/sudo
  sudo xattr -r -d com.apple.quarantine "@[email protected]"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:695

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads