4fbb1ebdae240e9a784ff893b113fe3244945ab322b4e733baa13a1a309ee4bf

Sharing

Copy URL Twitter E-mail

General

Target
4fbb1ebdae240e9a784ff893b113fe3244945ab322b4e733baa13a1a309ee4bf.gz
Size 2.0MB
Sample260722-nc84aaeb43
SHA256 4fbb1ebdae240e9a784ff893b113fe3244945ab322b4e733baa13a1a309ee4bf
MD5 d577e00d83444556f14015d368e6815c
SHA1 9d554a321001513dc5365632b7cf31939d4efa9b
SHA512 f28cad564937574d11128af38c3c429bfd07e39625805b6f91dc86606acc4ec86ba11709bb6b05b3c55c3f88a2eb2fac8861cd28a66e855b5879d1beb1b79a71
SSDEEP 49152:ks3VLh6Yg8mAug8Hzi3HPWHvCyQME/ewgm1pmvcxOqhVN1oTHDdor:p3j1g8918IWPVQMWEOiOOKSTHDdor
TLSH
T17095330C02DAF36AAADE7F80CDC9B8F41CC626F551857DD29A1DB4758F3A4A720E5D80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  .rsync/a/a
- Size 6KB
- SHA256 72edb1d7a64f7f65720f562e3f4ff8c3383e214adb2d6246668743eeeec3fdf1
- MD5 a811d27b9892d7c160c0a4f3e80ed665
- SHA1 92324ac67a329ae203846bdae87dc4547d974684
- SHA512 a34ac1d09057bce344ddd31a22967c72888174e29b34fd3d223a6b421dc53eb33a8d9902eb0236accbc6a5032cb7c33ef1d4e65106656f21bef9287433ed41f7
- SSDEEP 192:gfgH9BeKLOOuK/0HiBeKLOOuKYAV9HdnIllo:gfgDeg9ue0Seg9ubA7
- TLSH
  T101D1F90AF35857BBAE1D58E43CCB7D326C277696E4B10CE519C68781C8ECA0D78B021E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm defense_evasion discovery persistence rootkit
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Loads a kernel module
  Loads a Linux kernel module, potentially to achieve persistence
  rootkit
- Enumerates running processes
  Discovers information about currently running processes on the system
- Write file to user bin folder
  persistence
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  .rsync/a/init01
- Size 9KB
- SHA256 82eba36c8ac1613f451333eae4bff558e53cf814938d4b181790644371400eec
- MD5 e8ffc6aac5c2784b10319c25d229a44e
- SHA1 0bcdd833c497eebc1cbe003a091142a19f2cbf0c
- SHA512 197104ba26107fa8f235e708901a74d9220701721fbff0cac13306b6f1bf50ae0e947846239ec6053ca835d6ee6b0bda1ede6f69ac26f36d8af47d0579bf52f1
- SSDEEP 96:97gXuXmR7PofQH8h9GVQbxgeJwI2n2lznGWSKKFZ5W:97xmRbok8hAGbxPz900
- TLSH
  T1FB123A5F5577FCB9BB52D8A3D961672958E9D1898EF33998220EFB787080040F7340AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Attempts to change immutable files
  Modifies inode attributes on the filesystem to allow changing of immutable files.
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  .rsync/a/kswapd00
- Size 2.0MB
- SHA256 b2b0e9c58babd90047449f157261cc651e9c433ab1abaf3b5eb924184ef36c61
- MD5 3802abac30dd2a463bb2390392fcb49e
- SHA1 de52ae52b540374c7c9db8df8797e60fdae92ea0
- SHA512 bf214fdf615f5d39afc2add72bb410e770e3bc7b21063b39d10efdc7142f6d356d9dfee7a20a7142f32e497d557162bd4539d50f0cff657898180a0ee8747978
- SSDEEP 49152:2WD683TqbMtemJOGmHBox1Q6zBGlh53qInX:p6dM3OGUCoEBGbdX
- TLSH
  T1699533A1C27ED79387D3580C6846D9EFADA49E202B0AF1BBC952B6C1DDF9A30135414F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  .rsync/a/run
- Size 116B
- SHA256 c74456763d09eecb859b6e2cd05ccc49363698bf9a0f2e05908a7baa1911dc66
- MD5 52a98777306437c8f21cd8ecd9de2c26
- SHA1 ef1e62d634866475c673db2cdf16885b917898e6
- SHA512 e2995998e6b396116749980efb251aee2aea50e37b8ec5544eb4a65e5d741cbe6d447e9c1a595bb6ed6f0610d3f26d605b4e7a24d2a150c1edd65ad96d3b28fa
- TLSH
  T18DB0128408723D48B90C37F67B8B9E3DC1935E23911DB48191984A71F29D70BDC7928F
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral10 behavioral11 behavioral12 behavioral13
- Target
  .rsync/b/a
- Size 157B
- SHA256 dc43fdfbb5f7e8ecc80353dcd85889c0c08483c99acbce35b3ed8f399c936920
- MD5 17dfec62acb9bc298bb333fbe391f486
- SHA1 960fdc0a9c8dd4879c96ec76f69a9dedc6ec9795
- SHA512 21d49249ca656d3f6ce7a77876796590ae66d31963a6cdf65bb294ca45372e68686f8f7fd846035ed53f1155962447a8054bf2ea081e02fbb4b3fa1b6e376881
- TLSH
  T1CDC08CCC06F83308AEC8E662F50332F802C18A0CA80A9C03748A1AB2C2D43E238143C0
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Attempts to change immutable files
  Modifies inode attributes on the filesystem to allow changing of immutable files.
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral14 behavioral15 behavioral16 behavioral17
- Target
  .rsync/b/run
- Size 73KB
- SHA256 bbcb8075b98d143c022d8ca427a42c439ab72464f5335c10514ae959a4e743ba
- MD5 efa525c6083be0dc386321f130353c24
- SHA1 061571b328272cf0a908f796ab65c3eed3b00f3d
- SHA512 4b74b45de2f4d78dd8586c969f3beff515a53a0a5e5e25f9394501a0ebd39e897317c733b1598c4f6875edabcc305a849f1156d1b5233aeb3321470ee49c704e
- SSDEEP 1536:rG6dkLpUqE3VuQz7kG6dkLpUqE3VuQz7M:rXdkOeXdkOm
- TLSH
  T1B173D82AEE8F1D498BD16C021BCE09E469CC1789DCD45DDF500FE6985E6F03819EC6E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Attempts to change immutable files
  Modifies inode attributes on the filesystem to allow changing of immutable files.
behavioral18 behavioral19 behavioral20 behavioral21
- Target
  .rsync/b/stop
- Size 1KB
- SHA256 593ea276e442f1df193419307b24bdc11b050d34fe465db33289b79fd9e50ca8
- MD5 b010ac9859f9344e6300665418a17dfd
- SHA1 fcccfa7280f4f496b18b6332d1b8bba52c973e9f
- SHA512 3f58f006f3b4f4f09bc421a6e91da671a1ddd06ef5fc8ee6162c43e1836f591f569f559ca6de5068791c4177fb55d8338629cafe1a58528963680f2bdd453b2b
- TLSH
  T109214F0C6173FF7B5923EE72D661472585ABD48A88F73F1C1102BAB8B184009F73149E
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral22 behavioral23 behavioral24 behavioral25

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

File and Directory Permissions Modification

Executes dropped EXE

Loads a kernel module

Enumerates running processes

Write file to user bin folder

Attempts to change immutable files

Enumerates running processes

Enumerates running processes

File and Directory Permissions Modification

Attempts to change immutable files

Enumerates running processes

Attempts to change immutable files

Enumerates running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25