General
- Target NIH-IR-Linux.sh
- Size 138KB
- Sample260701-xlfb1aev8y
- SHA256 4a6bf7bdc0c5d6de6c4cc7910e880b2259c5a209cb7f5181055083a0b9ece2ef
Malware Config
Targets
-
- Target NIH-IR-Linux.sh
- Size 138KB
- SHA256 4a6bf7bdc0c5d6de6c4cc7910e880b2259c5a209cb7f5181055083a0b9ece2ef
Score7/10-
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
-
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Abuse sudo or cached sudo credentials to execute code.
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
-
Reads list of loaded kernel modules
Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
-
Reads network interface configuration
Fetches information about one or more active network interfaces.
-
Virtualization/Sandbox Evasion: Time Based Evasion
Adversaries may detect and evade virtualized environments and sandboxes.
-
Reads process memory
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Unix Shell
1Software Deployment Tools
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Virtualization/Sandbox Evasion
4System Checks
2Time Based Evasion
1Credential Access
OS Credential Dumping
2/etc/passwd and /etc/shadow
1Proc Filesystem
1