36d6d9f12964a43f247b07786cb66799b21560fe18a07a35b68c9294a6d5ef50

Sharing

Copy URL Twitter E-mail

General

Target
fancontroller.appimage.sh
Size 516B
Sample260708-wcmjaaez7t
SHA256 36d6d9f12964a43f247b07786cb66799b21560fe18a07a35b68c9294a6d5ef50
MD5 c84fcf59ef2aa6d52bbf58f87d2e19f2
SHA1 023747b0dc7ed8f6fde3c602d32c5a09f6198192
SHA512 8b3c5544d0ed79038b157470cee737e14d3febcf9b8608c8e0f92d81e757cecddc2646e7356fe267feb73f800724e6623cd43f0f97bdac533dca148dde28f6ea
TLSH
T1D8F00E24748300F0155E202AF38328408ED9A637EA7824E47A3BC2A3B3BD5C660EA342
MD5 SHA1 SHA512 TLSH

Score

7^/10

Malware Config

Targets

- Target
  fancontroller.appimage.sh
- Size 516B
- SHA256 36d6d9f12964a43f247b07786cb66799b21560fe18a07a35b68c9294a6d5ef50
- MD5 c84fcf59ef2aa6d52bbf58f87d2e19f2
- SHA1 023747b0dc7ed8f6fde3c602d32c5a09f6198192
- SHA512 8b3c5544d0ed79038b157470cee737e14d3febcf9b8608c8e0f92d81e757cecddc2646e7356fe267feb73f800724e6623cd43f0f97bdac533dca148dde28f6ea
- TLSH
  T1D8F00E24748300F0155E202AF38328408ED9A637EA7824E47A3BC2A3B3BD5C660EA342
- MD5 SHA1 SHA512 TLSH
Score

7^/10

credential_access defense_evasion discovery privilege_escalation antivm
- Deletes itself
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
- Attempts to change immutable files
  Modifies inode attributes on the filesystem to allow changing of immutable files.
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Deletes itself

OS Credential Dumping

Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Attempts to change immutable files

Checks mountinfo of local process

Enumerates running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9