General
- Target setup (1).sh
- Size 271B
- Sample260730-rlcyzsbm6y
- SHA256 f15b21a6d3a509293078e4d2743d3438c39ac376c3b39a27002426929d762a39
Malware Config
Extracted
-
ps1
-
exe.dropper
https://raw.githubusercontent.com/AbsoZed/SteamPrivEsc/master/nc.exe
-
exe.dropper
https://raw.githubusercontent.com/AbsoZed/SteamPrivEsc/master/RegLN.exe
Targets
-
- Target setup (1).sh
- Size 271B
- SHA256 f15b21a6d3a509293078e4d2743d3438c39ac376c3b39a27002426929d762a39
Score10/10-
Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE
-
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
-
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Abuse sudo or cached sudo credentials to execute code.
-
Deletes log files
Deletes log files on the system.
-
Modifies init.d
Adds/modifies system service, likely for persistence.
-
Write file to user bin folder
-
Writes file to system bin folder
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Unix Shell
1Software Deployment Tools
1Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Privilege Escalation
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Deobfuscate/Decode Files or Information
1Indicator Removal
1Clear Linux or Mac System Logs
1Virtualization/Sandbox Evasion
1System Checks
1