General
- Target 888.sh
- Size 1KB
- Sample260729-xc4y1azdpc
- SHA256 bfad48c674265fcc40a9cb6e410a702c609dc689fb71e7e34b721c0bdd49aefd
- MD5 1d7f4dc3bb0f1c1402bded5c627cf3cc
- SHA1 fdf7f6c3ff116b1076564fc498475ba91d1c82f7
- SHA512 c79f8c8f933f40d77b341f48051975b82db6a3c30d7f9ddfc7abcce8a03466acfb8f8bbf95026f5e29cbb9edb9f318aa3c2c21f7eae04d2d1a1a70d951147292
- TLSH T1162121D6B0207E70298FD92820FE281C7282112F2F9D6D6CB0CB446576FC586787CE2C
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
888.sh
Resource
ubuntu1804-amd64-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
888.sh
Resource
debian9-armhf-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
888.sh
Resource
debian9-mipsbe-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
888.sh
Resource
debian9-mipsel-20260513-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target 888.sh
- Size 1KB
- SHA256 bfad48c674265fcc40a9cb6e410a702c609dc689fb71e7e34b721c0bdd49aefd
- MD5 1d7f4dc3bb0f1c1402bded5c627cf3cc
- SHA1 fdf7f6c3ff116b1076564fc498475ba91d1c82f7
- SHA512 c79f8c8f933f40d77b341f48051975b82db6a3c30d7f9ddfc7abcce8a03466acfb8f8bbf95026f5e29cbb9edb9f318aa3c2c21f7eae04d2d1a1a70d951147292
- TLSH T1162121D6B0207E70298FD92820FE281C7282112F2F9D6D6CB0CB446576FC586787CE2C
- MD5 SHA1 SHA512 TLSH
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Write file to user bin folder