General

  • Target

    bins.sh

  • Size

    10KB

  • Sample

    241027-3c4wwswalr

  • MD5

    d8ec12ed2845ad2e0438b2877c6b582d

  • SHA1

    a3ac76cc85f6efe3ee7d9dc250c3167a1316c3b3

  • SHA256

    0e50b03feb061f9e04117e63128d3cb941c873102a9471b2f0af8ea3cdc8de24

  • SHA512

    459b2e4080a48df3a9e1bcb0b60ca4c80cc2c0b477289a9db6ac26410638c43ecc9c345277a59f191be55b9b37bf113d558d4d1bc8316777707737d80b280d96

  • SSDEEP

    192:P/TslVfHcsv+SU0iyP8okBODl/V1aBVpqcsv+So/TslVNiyP8okrzV1aBV2:P/TslVfHcsv+SU0iyP8oYODlmqcsv+Sg

Malware Config

Targets

    • Target

      bins.sh

    • Size

      10KB

    • MD5

      d8ec12ed2845ad2e0438b2877c6b582d

    • SHA1

      a3ac76cc85f6efe3ee7d9dc250c3167a1316c3b3

    • SHA256

      0e50b03feb061f9e04117e63128d3cb941c873102a9471b2f0af8ea3cdc8de24

    • SHA512

      459b2e4080a48df3a9e1bcb0b60ca4c80cc2c0b477289a9db6ac26410638c43ecc9c345277a59f191be55b9b37bf113d558d4d1bc8316777707737d80b280d96

    • SSDEEP

      192:P/TslVfHcsv+SU0iyP8okBODl/V1aBVpqcsv+So/TslVNiyP8okrzV1aBV2:P/TslVfHcsv+SU0iyP8oYODlmqcsv+Sg

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

    • Executes dropped EXE

    • Renames itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Enterprise v15

Tasks