General
- Target k.php.sh
- Size 48KB
- Sample260730-qlgrhaswfs
- SHA256 2ec961162dd43e87b68abf63977c983d5c4a8dcd77caa399faa72914734d022b
Score
8/10
Malware Config
Targets
-
- Target k.php.sh
- Size 48KB
- SHA256 2ec961162dd43e87b68abf63977c983d5c4a8dcd77caa399faa72914734d022b
Score8/10-
Modifies password files for system users/ groups
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
-
Adds a user to the system
MITRE ATT&CK Enterprise v16
Defense Evasion
Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Modify Authentication Process
1Pluggable Authentication Modules
1Virtualization/Sandbox Evasion
1System Checks
1Credential Access
Modify Authentication Process
1Pluggable Authentication Modules
1OS Credential Dumping
1/etc/passwd and /etc/shadow
1