General
- Target setup (4).sh
- Size 222B
- Sample260731-n72mpafm61
- SHA256 ad0a9afe3bc13fa1b8d8c8ab6723cb23b6939749e2c470edf51eb2df0d95f855
Score
7/10
Malware Config
Targets
-
- Target setup (4).sh
- Size 222B
- SHA256 ad0a9afe3bc13fa1b8d8c8ab6723cb23b6939749e2c470edf51eb2df0d95f855
Score7/10-
Executes dropped EXE
-
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
-
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Abuse sudo or cached sudo credentials to execute code.
-
Deletes log files
Deletes log files on the system.
-
Modifies init.d
Adds/modifies system service, likely for persistence.
-
Write file to user bin folder
-
Writes file to system bin folder
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Unix Shell
1Software Deployment Tools
1Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Privilege Escalation
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Indicator Removal
1Clear Linux or Mac System Logs
1Virtualization/Sandbox Evasion
1System Checks
1