General

  • Target

    bins.sh

  • Size

    10KB

  • Sample

    241105-dp6tkssnfy

  • MD5

    0ea9efb7a3fdba996f8b872736a7a6cd

  • SHA1

    5a8d062a71760292104145657afa6e8daacd7457

  • SHA256

    8eeb29ed0d57089fbcd018f39c10b663354fee9db28566a6434d5c3e853a068f

  • SHA512

    1fd3740840ba34a38aeddc74348d85d2c1865025757019590e2c8b953b9cb44d26ae7bc597c1973e14760f26900e023eb6a6472c4cbac674025e9e7d4bdaced5

  • SSDEEP

    192:avYEUrDyIS+g1Fm1l1i2h0WS0T0ArTBlMJF9EUFbhYEUrD5S+g1FW1l1i2L0WS0b:apIS+g1Fm1l1i2CWTwArTBlMJF9EUFb4

Malware Config

Targets

    • Target

      bins.sh

    • Size

      10KB

    • MD5

      0ea9efb7a3fdba996f8b872736a7a6cd

    • SHA1

      5a8d062a71760292104145657afa6e8daacd7457

    • SHA256

      8eeb29ed0d57089fbcd018f39c10b663354fee9db28566a6434d5c3e853a068f

    • SHA512

      1fd3740840ba34a38aeddc74348d85d2c1865025757019590e2c8b953b9cb44d26ae7bc597c1973e14760f26900e023eb6a6472c4cbac674025e9e7d4bdaced5

    • SSDEEP

      192:avYEUrDyIS+g1Fm1l1i2h0WS0T0ArTBlMJF9EUFbhYEUrD5S+g1FW1l1i2L0WS0b:apIS+g1Fm1l1i2CWTwArTBlMJF9EUFb4

    • Contacts a large (2040) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

    • Executes dropped EXE

    • Renames itself

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Enterprise v15

Tasks