General
-
Target
sh.sh
-
Size
1KB
-
Sample
241023-tanbpaybla
-
MD5
f9ed4d262b278dd9ac2e431ff815733f
-
SHA1
5258173bc58a87e27eed00dcf011964b0cda0b4d
-
SHA256
23649baa562f333f2dd5614dd74dc370bd242c19e90e064f5a516adc5d8dae5e
-
SHA512
f353f15b60fc45267029a031609845587c1c7d474596a93aefb357db2b394aebf116ec581441b90494b7e9ba5f1e9921014a2a3a872a63daedee18d05ea4da6e
Static task
static1
Behavioral task
behavioral1
Sample
sh.sh
Resource
ubuntu2404-amd64-20240523-en
Malware Config
Targets
-
-
Target
sh.sh
-
Size
1KB
-
MD5
f9ed4d262b278dd9ac2e431ff815733f
-
SHA1
5258173bc58a87e27eed00dcf011964b0cda0b4d
-
SHA256
23649baa562f333f2dd5614dd74dc370bd242c19e90e064f5a516adc5d8dae5e
-
SHA512
f353f15b60fc45267029a031609845587c1c7d474596a93aefb357db2b394aebf116ec581441b90494b7e9ba5f1e9921014a2a3a872a63daedee18d05ea4da6e
-
Contacts a large (7576656) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
XMRig Miner payload
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Attempts to change immutable files
Modifies inode attributes on the filesystem to allow changing of immutable files.
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
-
Reads network interface configuration
Fetches information about one or more active network interfaces.
-
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
2System Checks
2