General
- Target 3eeec8cc2846d788b567f8a1c283901dd71f32a05623783172af5d1bf6839835
- Size 52KB
- Sample260714-246dcshv3t
- SHA256 3eeec8cc2846d788b567f8a1c283901dd71f32a05623783172af5d1bf6839835
Malware Config
Targets
-
- Target 3eeec8cc2846d788b567f8a1c283901dd71f32a05623783172af5d1bf6839835
- Size 52KB
- SHA256 3eeec8cc2846d788b567f8a1c283901dd71f32a05623783172af5d1bf6839835
Score7/10-
Executes dropped EXE
-
Modifies PAM framework files
Modifies Linux PAM framework files, possibly to intercept credentials.
-
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Deletes log files
Deletes log files on the system.
-
Modifies init.d
Adds/modifies system service, likely for persistence.
-
Write file to user bin folder
-
Writes file to system bin folder
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Modify Authentication Process
1Pluggable Authentication Modules
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Defense Evasion
Deobfuscate/Decode Files or Information
1Indicator Removal
1Clear Linux or Mac System Logs
1Modify Authentication Process
1Pluggable Authentication Modules
1Virtualization/Sandbox Evasion
1System Checks
1Credential Access
Modify Authentication Process
1Pluggable Authentication Modules
1OS Credential Dumping
1/etc/passwd and /etc/shadow
1