General

  • Target

    bins.sh

  • Size

    10KB

  • Sample

    241110-ha7jsavker

  • MD5

    da1794480aa55cfa4d7018d526c4de4a

  • SHA1

    174d387fcdca8c42d967e377d66905560dfb2bf8

  • SHA256

    1075108727fb2a9154c8da738ab09ec6210e749690862a7c47c0ecf143e5fb54

  • SHA512

    fa02882fd85a098e8d52d845e0f2e182070978c2f87e59ebaddc4c96af5691e6f1532347c1ae71a9a00d539a113afec2ccc1fab309e41ba2531cf2c2dcf92dd4

  • SSDEEP

    192:HHDgl9IAZBSf7K8ZBdg0uO1U9Q43m8dqZBPg0yQ43m8dEHDgl9fZBSf7v:jQ8ZBdg0uO1U8ZBPg03

Malware Config

Targets

    • Target

      bins.sh

    • Size

      10KB

    • MD5

      da1794480aa55cfa4d7018d526c4de4a

    • SHA1

      174d387fcdca8c42d967e377d66905560dfb2bf8

    • SHA256

      1075108727fb2a9154c8da738ab09ec6210e749690862a7c47c0ecf143e5fb54

    • SHA512

      fa02882fd85a098e8d52d845e0f2e182070978c2f87e59ebaddc4c96af5691e6f1532347c1ae71a9a00d539a113afec2ccc1fab309e41ba2531cf2c2dcf92dd4

    • SSDEEP

      192:HHDgl9IAZBSf7K8ZBdg0uO1U9Q43m8dqZBPg0yQ43m8dEHDgl9fZBSf7v:jQ8ZBdg0uO1U8ZBPg03

    • Contacts a large (1773) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

    • Executes dropped EXE

    • Renames itself

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Enterprise v15

Tasks