General

  • Target

    bins.sh

  • Size

    10KB

  • Sample

    241127-3wpw3swmgv

  • MD5

    49872aca6c4f6270930cf024ecb01ed7

  • SHA1

    6410b90c875eee4efbb3f5fc5fbdaeb388a807a8

  • SHA256

    3561a25654068e9ddfa3d6337868db3e7adef236e93e5292a128d879f3eb20d2

  • SHA512

    355155ec68f0f890dacacf2926b13260cd4cdcf4e8227d7405a8c5508d064c56722442ca29d438a89c57e58c166889ba39d4fadfd92459f193a8933e56ff9a17

  • SSDEEP

    96:TffBsa4wIyfLT2+qymWRZS5B364NNUy59X5B364NFi0p9uVffBszeXedVymWRZa4:TffBsajS5B362NUy5B5B362yffBsUZ

Malware Config

Targets

    • Target

      bins.sh

    • Size

      10KB

    • MD5

      49872aca6c4f6270930cf024ecb01ed7

    • SHA1

      6410b90c875eee4efbb3f5fc5fbdaeb388a807a8

    • SHA256

      3561a25654068e9ddfa3d6337868db3e7adef236e93e5292a128d879f3eb20d2

    • SHA512

      355155ec68f0f890dacacf2926b13260cd4cdcf4e8227d7405a8c5508d064c56722442ca29d438a89c57e58c166889ba39d4fadfd92459f193a8933e56ff9a17

    • SSDEEP

      96:TffBsa4wIyfLT2+qymWRZS5B364NNUy59X5B364NFi0p9uVffBszeXedVymWRZa4:TffBsajS5B362NUy5B5B362yffBsUZ

    • Contacts a large (2025) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

    • Executes dropped EXE

    • Renames itself

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Enterprise v15

Tasks