General

  • Target

    bins.sh

  • Size

    10KB

  • Sample

    241120-kr54dsyqcq

  • MD5

    5043473f1d1be685c2c3cd5616d93b8b

  • SHA1

    24aa735b4efb07ddf576d7af72a4cc3acbdf3d90

  • SHA256

    ea6218dddd55f83c7a5ebd320b1a0f5a31a7ca34ae8b5cb1f46ce333442e7c2d

  • SHA512

    b59ae01412c9c4828947586654be13f48fb5cda3a2ff42c57fe636520260f3f8f5975bdbe4b4883cfed3c1014cf2b4d73cf196deafe7accc98e9a341adb4f23b

  • SSDEEP

    192:4hja2joogwd9ovzbVksHC+OZ2qZEEidvKa2joozCd9ovz1ksHC+W2qZEEx:A0TMiX

Malware Config

Targets

    • Target

      bins.sh

    • Size

      10KB

    • MD5

      5043473f1d1be685c2c3cd5616d93b8b

    • SHA1

      24aa735b4efb07ddf576d7af72a4cc3acbdf3d90

    • SHA256

      ea6218dddd55f83c7a5ebd320b1a0f5a31a7ca34ae8b5cb1f46ce333442e7c2d

    • SHA512

      b59ae01412c9c4828947586654be13f48fb5cda3a2ff42c57fe636520260f3f8f5975bdbe4b4883cfed3c1014cf2b4d73cf196deafe7accc98e9a341adb4f23b

    • SSDEEP

      192:4hja2joogwd9ovzbVksHC+OZ2qZEEidvKa2joozCd9ovz1ksHC+W2qZEEx:A0TMiX

    • Contacts a large (1320) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

    • Executes dropped EXE

    • Renames itself

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Enterprise v15

Tasks