General
- Target kla.sh
- Size 2KB
- Sample260719-pflb3aay4p
- SHA256 2d2be0eefdf649cff2a51ba6e11d20014e4203883791f1b8ae8cb56f2d245917
- MD5 59817a56b8d7bef7341f44d692f2d9fd
- SHA1 2a15f715883f138a5583ddce00f5b958cdd29953
- SHA512 704668dafb4be1425b678a64d6b30787d1521611e62fcf164b0747bd7c4d805884a8d0a333dbdeafa24640ecb8a0ac2b8a4602bfa33ef588cddafce7c17eb59d
- TLSH T1835166C422A22D703CE69D2B71698864B5C676C1EDC24FC1A0DDF9F568CDF09B905AB3
- MD5 SHA1 SHA512 TLSH
Score
7/10
Static task
static1
Behavioral task
behavioral1
Sample
kla.sh
Resource
ubuntu1804-amd64-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
kla.sh
Resource
debian9-armhf-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
kla.sh
Resource
debian9-mipsbe-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
kla.sh
Resource
debian9-mipsel-20260513-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target kla.sh
- Size 2KB
- SHA256 2d2be0eefdf649cff2a51ba6e11d20014e4203883791f1b8ae8cb56f2d245917
- MD5 59817a56b8d7bef7341f44d692f2d9fd
- SHA1 2a15f715883f138a5583ddce00f5b958cdd29953
- SHA512 704668dafb4be1425b678a64d6b30787d1521611e62fcf164b0747bd7c4d805884a8d0a333dbdeafa24640ecb8a0ac2b8a4602bfa33ef588cddafce7c17eb59d
- TLSH T1835166C422A22D703CE69D2B71698864B5C676C1EDC24FC1A0DDF9F568CDF09B905AB3
- MD5 SHA1 SHA512 TLSH
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Deletes itself
-
Executes dropped EXE
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates running processes
Discovers information about currently running processes on the system