General

  • Target

    bins.sh

  • Size

    10KB

  • Sample

    241127-qp3s5svngz

  • MD5

    9d8a49cd0f4e56ee8f40f51da5a95f68

  • SHA1

    8c09a20a815b3ba34acb0e385a4158f153f092c8

  • SHA256

    ea43a75e8b511e3815f167d34c63db2e593d77e20fe5ce3ab4030b84039ef309

  • SHA512

    443eaec991fc60b193997b30944ac7e6097cd831836b1aefa6872ef2c0a3856854aae7ebd430072c679df883b5ad4167537aca91367a56cf13d15b70c55b584b

  • SSDEEP

    192:EB6K67v/lzDzjuOPIskTD2A6iKlBm2C+HB/E6K67vlzDzjuORIskTDE6iKlBjC+4:EB6K67v/BnIskTD2A6iKlBmS/E6K67vV

Malware Config

Targets

    • Target

      bins.sh

    • Size

      10KB

    • MD5

      9d8a49cd0f4e56ee8f40f51da5a95f68

    • SHA1

      8c09a20a815b3ba34acb0e385a4158f153f092c8

    • SHA256

      ea43a75e8b511e3815f167d34c63db2e593d77e20fe5ce3ab4030b84039ef309

    • SHA512

      443eaec991fc60b193997b30944ac7e6097cd831836b1aefa6872ef2c0a3856854aae7ebd430072c679df883b5ad4167537aca91367a56cf13d15b70c55b584b

    • SSDEEP

      192:EB6K67v/lzDzjuOPIskTD2A6iKlBm2C+HB/E6K67vlzDzjuORIskTDE6iKlBjC+4:EB6K67v/BnIskTD2A6iKlBmS/E6K67vV

    • Contacts a large (2062) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

    • Executes dropped EXE

    • Renames itself

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Enterprise v15

Tasks