General
- Target NIH-IR-Linux-v7-portable-toolkit.sh
- Size 118KB
- Sample260702-ter6fahs7x
- SHA256 9b3a227eb4efe6ed55f4e6bbf3a498a78dfcbf124e6b0e36b1a3f6fc083cfc68
Malware Config
Targets
-
- Target NIH-IR-Linux-v7-portable-toolkit.sh
- Size 118KB
- SHA256 9b3a227eb4efe6ed55f4e6bbf3a498a78dfcbf124e6b0e36b1a3f6fc083cfc68
Score7/10-
Looks for SUID binaries
Searches the filesystem for potential binaries to be used for privilege escalation (common during reconnaissance activity).
-
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
-
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Abuse sudo or cached sudo credentials to execute code.
-
Reads AppArmor ptrace settings
Discovery of allowed ptrace capabilities by AppArmor.
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
-
Reads list of loaded kernel modules
Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
-
Reads network interface configuration
Fetches information about one or more active network interfaces.
-
Virtualization/Sandbox Evasion: Time Based Evasion
Adversaries may detect and evade virtualized environments and sandboxes.
-
Reads process memory
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Unix Shell
1Software Deployment Tools
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Virtualization/Sandbox Evasion
4System Checks
2Time Based Evasion
1Credential Access
OS Credential Dumping
2/etc/passwd and /etc/shadow
1Proc Filesystem
1