Extracted

• • Target
    massload.sh
  • Size 2KB
  • SHA256 b46e0f56ac76e1b12f03fd1e13fa3f61acfd40e974f5aa031c969aec6a6309e4
  • MD5 0b980fe13f76c70f5f35ff9eb51cb476
  • SHA1 7f130c9bbf06d9d00eb3e871d49c93eb66b99f70
  • SHA512 a84e52432847212ac76dcfadc90d3eab625c50429434281dd7981a70751db9c51c92da58855be7b073c7bdb10fc7b95b2801b84f59181f137efb1708353aae62
  • TLSH
    T1F351C6F8A9A397F39FD9CF4460615A19B40BAAC634B28EDC9C9E34F495BC484F830516
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryantivm

  • Contacts a large (56366) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1behavioral2behavioral3behavioral4