fc1d305e289f127b867f2a9edb135733d773ce29a51558c983d8db8e86124a75

Sharing

Copy URL Twitter E-mail

General

Target
klyc-pmm.zip
Size 66KB
Sample260730-k8yewayvax
SHA256 fc1d305e289f127b867f2a9edb135733d773ce29a51558c983d8db8e86124a75
MD5 f7da4c35211ba16d3725aa3db1989022
SHA1 0eb33337bb83134c31d0cf73759d693aeec878ad
SHA512 a0e544d7deca76774e40d83fbe4c964710326d022bf3a8b40bd45f4d455e74e51ec54fd217071706d6d1b838bb62c35b20dfc8a27f86127475667b5c5884cf3e
SSDEEP 1536:9v/ZeLclctf3XRsWTk/3dNuJdUIXxKf3XRsWTk/3dN7L:9HZeLgOf3XRsWTY7uUIKf3XRsWTY7X
TLSH
T17463F1B4CCE7AC66FA0FD636F41697C9E3001487305AA44BDBD9FB19A29D0EC3B10995
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  klyc-pmm/examples/quickstart.sh
- Size 2KB
- SHA256 754eeba13b1609ac86c4f18805e20aff19dd0609bc8270deb95430700ad8eba3
- MD5 8c2c1f09839ab9bdb602023429a920e6
- SHA1 658f837117fdc819a5e01955cf4661aff78f776d
- SHA512 90d6a2fbd1fbe2d118713b5d77563c7d9f36cf2de4bdffe5bde11a9cd9eb38a19e0de8eec70df30484ff27fd5cc331e273cf2bbc77db45cc4a2d23d57d24d528
- TLSH
  T1C241B7BD78547932380111EC492292083647F21F45A458A7F7EBA41F3F60AED355D6B9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery antivm
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  klyc-pmm/pmm_watch.sh
- Size 58KB
- SHA256 a206fbc65f64f26110b7fb849c775b9fe418cf3ebe21d46942f00d1fc1214523
- MD5 b2f8fd031f3f5773caaf942ed75b7321
- SHA1 e2f8b28fd0547ca2ce652be5894f77a9395d9d2d
- SHA512 3447450d4ec50dc891da172042d7ee872a74086801c8dfb0a6439bbc08870e70572637f577d1273be25be7fe8ea4f9baa82193238a427ca7db880332e9460a34
- SSDEEP 768:7SxuqGvsO5gJB2sXJMe1YZ9A33OuFT1hYQ1Uj563A5Jn/L6bKe8yDHa2ivbIrd4V:OkIBpb3hZ2Qw5Jn/L5e8yDaIYZh
- TLSH
  T15F439335B95185B02149DD3CAAFE9C003119111BC1486C19B9AFF6D82FBC76CFAFA279
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  klyc-pmm/publish.sh
- Size 6KB
- SHA256 4f2e87dfa64b65efe2a2382935a82ec4605065cd45201ae4ab107c99cf578121
- MD5 d06fc3e43fca73d7c1974fc648af6e09
- SHA1 5639dfae9b7fe852e1f20125380cbcdf84b01482
- SHA512 351f71238fb920b7f7dff219c411f85c7f668df787a7b0ce25ed6e592a7deeb1b057e1747953d0d45b4430c897f6703dcdf9d55ad7a072dd24b7b698923a49dd
- SSDEEP 96:UW22aUq6cUdG+TCu62/1hd1voXGOD/D/JD+c3gzNnr7n1J/1t:Pk6cqlTCg/1hXvQD/D/JD7GN7j
- TLSH
  T184E1003D2910B92039071D7D9A71BE043393361FC089AA5760EBF0D99EF46CCDC6AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  klyc-pmm/scripts/install-daemon.sh
- Size 5KB
- SHA256 cef636fc753bb360b684dda899f6caef8886906da9fddd9e0c14eaf4446edb74
- MD5 420fd5ac3754810e27bd97d39c87149e
- SHA1 fda3dc5bff024ae10e51a0d4ee0b51b300df0a4c
- SHA512 9cbb8f06282c840013ddde7686985b7e9fa7e61ce4124213df3886ac52fc34988b4e3e870654d6bcc3c6809ea85207d2b8d4ad1b67d727d7ba89bf02d282c735
- SSDEEP 96:MIUmyGlqSI7zPDNOfioJTJGtq41wvP472sNeIMxkGQduHWv0T0:jyRZZOfbTMk41OqMWGQ4o
- TLSH
  T1B5C12FB5B52589B07844CE789BF64C00B42A301FC980AC4A399E75F40FF9590FEF997A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  klyc-pmm/scripts/oneclick.sh
- Size 9KB
- SHA256 5b6028d8e79e971fb418e02d100b91250277377cb02f8bac4f2fdb95a50be47d
- MD5 cf7850f0eae5586ebd562af0aab85727
- SHA1 a920343ae82f45e5964072e72ba156808f758f9a
- SHA512 2b520d1a1aee562ae5bc580934e9635de4ffdaa3f8bc3fa90ac36357c80f93a89ccfdbc5149bfcf9b4baf490839bdf02e3bd6c2bb42a3067e86d7959be43b2bd
- SSDEEP 192:JJqhsRSiaNALb2h5pVnB3gOeCEluW1ws6doFnD:JJqhsQiaNx9Rl+1OCD
- TLSH
  T17C1213B6740846753808BE2449FA0C04A61A1603D940DD18B95FB5FA1F7ABA1FFEC36F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access defense_evasion discovery execution persistence antivm
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Write file to user bin folder
  persistence
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  klyc-pmm/scripts/pmm_backup_files.sh
- Size 2KB
- SHA256 963363eacbb725090b18f839fcbb23434400511b8dfb2ba638c222a9586187d6
- MD5 3c9dfd615f7cc6a789946fb01407d7fa
- SHA1 64e5bc3e527000c99ef6b19f6704a9efddfc7056
- SHA512 95b2fc7ec158e4c1e9c8a604661b6e694501f4710aa07e3e9f28b9539322c2134295d3fdd0a4cc255bc7f8096e9d3061837c2048ee49e16d74a56e3f5d6f5e38
- TLSH
  T1744164E97001A431770D95FA34BF681C75128D9F40A4B814B0EF92B86F9CBB633F6695
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  klyc-pmm/scripts/pmm_boot.sh
- Size 848B
- SHA256 f678ecfeebe9986f992e2d7a3a7098564eb63d7c166d69b24732358b721c4e63
- MD5 dec7f68ac13e26ab0b9c07739428d8ea
- SHA1 a0aa1dc8cb442281be9e67a42cf74bb3e870cfdd
- SHA512 649b72d91e8df156e05368295296a28bf2d725dd0b62d971623b428d5fb216ce0d7cb0f1c3be44964753ff36eeb4a6b12238dcbef665e21b30a8ad53f27fea54
- TLSH
  T14E0123E510353334ED635A443F9B200A5111DFFE65CCD95CC0D5F04FD6A8B9C10E0A24
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral25 behavioral26 behavioral27 behavioral28
- Target
  klyc-pmm/scripts/pmm_distill.sh
- Size 10KB
- SHA256 3bffc67d97ebec2bb68b739594755ad69fe4de01a3e33b2208b0f047bbcaee31
- MD5 3affc8cdce3c22c84d2acc1bc25f8e1c
- SHA1 2847b3dd348de9d59f86cc9ede25e90e129d3e0e
- SHA512 dc7aa27713e6d841febfc846ef31485b63bca29c79a1edb2c7ce6c78ad7104ffa2870399ef37622785ae3193044cd38a0483cd9aebe95223e77415ab12bb96c7
- SSDEEP 96:6yRDcgcIPB84rlLvldT7jz6Ym7QXI7q2A0dW2iqzJqZevzsieiZikf7i6bynzVEj:6yRwBOWt7+jFAz9AyeHzVOdV9b
- TLSH
  T1612297AFB97AACB030198C2CC1755C543546A00FD5252C763D1AA9FD4FB8E5CCCBD9A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30 behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

OS Credential Dumping

Deletes log files

Write file to user bin folder

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32