General
- Target sora.x86_64
- Size 3.7MB
- Sample260707-pc2jwahs7v
- SHA256 93ffa6afdbc71c9f6a0a8752ccdbbf697a7e2cca5a146bf010cb885140287522
Malware Config
Targets
-
- Target sora.x86_64
- Size 3.7MB
- SHA256 93ffa6afdbc71c9f6a0a8752ccdbbf697a7e2cca5a146bf010cb885140287522
Score8/10-
Modifies password files for system users/ groups
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
-
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
-
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Abuse sudo or cached sudo credentials to execute code.
-
Adds a user to the system
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Modify Authentication Process
1Pluggable Authentication Modules
1Privilege Escalation
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Modify Authentication Process
1Pluggable Authentication Modules
1