General
- Target linpeas.sh
- Size 1.0MB
- Sample260506-pjdfmaev7p
- SHA256 6fb997878c8e4a4706f8b7884151ebbcabe52c774fef8314b1f8f441a7acf9a7
Malware Config
Targets
-
- Target linpeas.sh
- Size 1.0MB
- SHA256 6fb997878c8e4a4706f8b7884151ebbcabe52c774fef8314b1f8f441a7acf9a7
Score7/10-
Creates Raw socket
Creates a socket that captures raw packets at the device level
-
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
-
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Abuse sudo or cached sudo credentials to execute code.
-
Reads AppArmor ptrace settings
Discovery of allowed ptrace capabilities by AppArmor.
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Checks mountinfo of local process
Checks mountinfo of running processes which indicate if it is running in chroot jail.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads data from the clipboard
Attempts to collect data stored in the clipboard using xclip tool.
-
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
-
Reads network interface configuration
Fetches information about one or more active network interfaces.
-
Uses Polkit to run commands
Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.
-
Virtualization/Sandbox Evasion: Time Based Evasion
Adversaries may detect and evade virtualized environments and sandboxes.
-
Reads process memory
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Python
1Software Deployment Tools
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Virtualization/Sandbox Evasion
4System Checks
3Time Based Evasion
1Credential Access
OS Credential Dumping
2/etc/passwd and /etc/shadow
1Proc Filesystem
1Discovery
Process Discovery
1Remote System Discovery
1System Information Discovery
4System Network Configuration Discovery
3Internet Connection Discovery
1System Network Connections Discovery
2Virtualization/Sandbox Evasion
4System Checks
3Time Based Evasion
1