General
- Target vcimanagement.x86.elf
- Size 12.5MB
- Sample260707-kphv3sbt2p
- SHA256 793272436a619ecefc9a7e676b58553fe8b94f22fd95bf86c35ecdfba192224d
Malware Config
Targets
-
- Target vcimanagement.x86.elf
- Size 12.5MB
- SHA256 793272436a619ecefc9a7e676b58553fe8b94f22fd95bf86c35ecdfba192224d
Score8/10-
Modifies password files for system users/ groups
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
-
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
-
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Abuse sudo or cached sudo credentials to execute code.
-
Adds a user to the system
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Modify Authentication Process
1Pluggable Authentication Modules
1Privilege Escalation
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Modify Authentication Process
1Pluggable Authentication Modules
1