Extracted

• • Target
    massload.sh
  • Size 2KB
  • SHA256 2fec9e0b2f970164ab4890848295904d4ae372c136aa25ccba5dab27e446b2c3
  • MD5 572f02a5fd7075196f22cb69505920ec
  • SHA1 531b2c23e837a5bc548c59c137eced8f0b9c926a
  • SHA512 e78c8ff78f25e044c39ffb6f67e4e8da4385993406734f23f3606547c2d5c75e7bf78ea600b18ecb768ab817033648f02b9d85306ff17839378db35ab8b02803
  • TLSH
    T16151C6B8A96397F39FD9CF4460615A19B40BEAC634B28EDC9C9E34F495BC484F830516
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryantivm

  • Contacts a large (51526) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1behavioral2behavioral3behavioral4