Overview

overview

8

Static

static

1

8cd37b3de2...bin.sh

ubuntu-18.04-amd64

8

8cd37b3de2...bin.sh

debian-9-armhf

8

8cd37b3de2...bin.sh

debian-9-mips

8cd37b3de2...bin.sh

debian-9-mipsel

Sharing

Copy URL Twitter E-mail

General

  • Target
    8cd37b3de2d4e175cde202ef3bd2c51ab1f48053c46701efa470a250ff300e5a_from_78.27.235.70_redis_set.bin.sh
  • Size 930B
  • Sample260731-mtpwasgh87
  • SHA256 8cd37b3de2d4e175cde202ef3bd2c51ab1f48053c46701efa470a250ff300e5a
  • MD5 SHA1 SHA512 TLSH
Score
8/10
discoverylinuxpersistenceprivilege_escalation

Malware Config

Targets

    • Target
      8cd37b3de2d4e175cde202ef3bd2c51ab1f48053c46701efa470a250ff300e5a_from_78.27.235.70_redis_set.bin.sh
    • Size 930B
    • SHA256 8cd37b3de2d4e175cde202ef3bd2c51ab1f48053c46701efa470a250ff300e5a
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    discoverypersistenceprivilege_escalation

    • Adds new SSH keys

      Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

      persistenceprivilege_escalation

    • Modifies the /etc/hosts DNS resolution file

      Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v16

Tasks