General
- Target rip.sh
- Size 298B
- Sample260708-vxavjsdt7r
- SHA256 febe419894f924442d51111ea968c3feb3887d90f3556d51a5eea10bdc8125de
- MD5 118fef2d937589a8e16eb44551ee83b3
- SHA1 891b6155292c90c8b1b562385a36db556cbbafa2
- SHA512 343f57763d32d04df1e7f570c0b70cbe88176edad8dd0915a4f2e6deac427383a9858f5231fe8353768e6fc2209673c14c17814e18aeedbc56d2649052e7f945
- TLSH T136E0E754504115C7075C44793143A4041F8D5972FD7D21D52527D165C58C69D10571D0
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
rip.sh
Resource
ubuntu2404-amd64-20260126-en
6 signatures
900 seconds
Malware Config
Targets
-
- Target rip.sh
- Size 298B
- SHA256 febe419894f924442d51111ea968c3feb3887d90f3556d51a5eea10bdc8125de
- MD5 118fef2d937589a8e16eb44551ee83b3
- SHA1 891b6155292c90c8b1b562385a36db556cbbafa2
- SHA512 343f57763d32d04df1e7f570c0b70cbe88176edad8dd0915a4f2e6deac427383a9858f5231fe8353768e6fc2209673c14c17814e18aeedbc56d2649052e7f945
- TLSH T136E0E754504115C7075C44793143A4041F8D5972FD7D21D52527D165C58C69D10571D0
- MD5 SHA1 SHA512 TLSH
-
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
-
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Abuse sudo or cached sudo credentials to execute code.
-
Checks mountinfo of local process
Checks mountinfo of running processes which indicate if it is running in chroot jail.
MITRE ATT&CK Enterprise v16
Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Virtualization/Sandbox Evasion
1System Checks
1