5941bcdd284bee798fb019c9169e9d534c5b28d668216ac7f05ac9d939ec434b

Sharing

Copy URL Twitter E-mail

General

Target
klyc-pmm.zip
Size 50KB
Sample260731-pel7zaac64
SHA256 5941bcdd284bee798fb019c9169e9d534c5b28d668216ac7f05ac9d939ec434b
MD5 e9f9de13ffeea0aed0e4770753a31879
SHA1 b260e38a3e5d4e9ed2aff57930209e5286d0487a
SHA512 3a8360edcc97e9aea8cb2a0207e9d98443e285fc7b774580cd58d0744bc8d2df717b22239d383cd5caca73063c72282fe3da93df7210e9da3967313f8ce6dc1a
SSDEEP 1536:RgAYeECXScABVhCuQSvAGiC6UbdAzh32DmoJyURXKon:RgwXShjhTdvZ6CdAzZ26of0u
TLSH
T1FE33E17CEED25CD0E72F67720D0E93C416815742530E7906AAAFE999FBCE6C11B21882
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  klyc-pmm/examples/quickstart.sh
- Size 2KB
- SHA256 754eeba13b1609ac86c4f18805e20aff19dd0609bc8270deb95430700ad8eba3
- MD5 8c2c1f09839ab9bdb602023429a920e6
- SHA1 658f837117fdc819a5e01955cf4661aff78f776d
- SHA512 90d6a2fbd1fbe2d118713b5d77563c7d9f36cf2de4bdffe5bde11a9cd9eb38a19e0de8eec70df30484ff27fd5cc331e273cf2bbc77db45cc4a2d23d57d24d528
- TLSH
  T1C241B7BD78547932380111EC492292083647F21F45A458A7F7EBA41F3F60AED355D6B9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery antivm
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  klyc-pmm/scripts/install-daemon.sh
- Size 6KB
- SHA256 afe82445129c523bdd049e4a33f9ba4f2a381cf7aa2a8d65229b466d84427369
- MD5 e2f4abc79d58a25d324337f659e1329c
- SHA1 7c05dda4417eed745792eeb137c184c918648349
- SHA512 13f4095f59654777a78ed30e0b18c0da0929ce948b32fdb857042af292864f236df3fe6c31f25b53ee2a54f6243403d37eeb34017682066a328f71c46c9c862f
- SSDEEP 96:iKUmyGlqSI7zPDNOfioJ4JGtq41wvc472sNeIMxkGQduHWv0T0:DyRZZOfb4Mk41dqMWGQ4o
- TLSH
  T191D120B5B52589B07848CD789BF64C00B419301FC980AC49399EB5F40FF9590FEF997A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  klyc-pmm/scripts/oneclick.sh
- Size 9KB
- SHA256 5b6028d8e79e971fb418e02d100b91250277377cb02f8bac4f2fdb95a50be47d
- MD5 cf7850f0eae5586ebd562af0aab85727
- SHA1 a920343ae82f45e5964072e72ba156808f758f9a
- SHA512 2b520d1a1aee562ae5bc580934e9635de4ffdaa3f8bc3fa90ac36357c80f93a89ccfdbc5149bfcf9b4baf490839bdf02e3bd6c2bb42a3067e86d7959be43b2bd
- SSDEEP 192:JJqhsRSiaNALb2h5pVnB3gOeCEluW1ws6doFnD:JJqhsQiaNx9Rl+1OCD
- TLSH
  T17C1213B6740846753808BE2449FA0C04A61A1603D940DD18B95FB5FA1F7ABA1FFEC36F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm credential_access defense_evasion discovery execution persistence
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Write file to user bin folder
  persistence
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  klyc-pmm/scripts/pmm_backup_files.sh
- Size 2KB
- SHA256 963363eacbb725090b18f839fcbb23434400511b8dfb2ba638c222a9586187d6
- MD5 3c9dfd615f7cc6a789946fb01407d7fa
- SHA1 64e5bc3e527000c99ef6b19f6704a9efddfc7056
- SHA512 95b2fc7ec158e4c1e9c8a604661b6e694501f4710aa07e3e9f28b9539322c2134295d3fdd0a4cc255bc7f8096e9d3061837c2048ee49e16d74a56e3f5d6f5e38
- TLSH
  T1744164E97001A431770D95FA34BF681C75128D9F40A4B814B0EF92B86F9CBB633F6695
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  klyc-pmm/scripts/pmm_boot.sh
- Size 848B
- SHA256 f678ecfeebe9986f992e2d7a3a7098564eb63d7c166d69b24732358b721c4e63
- MD5 dec7f68ac13e26ab0b9c07739428d8ea
- SHA1 a0aa1dc8cb442281be9e67a42cf74bb3e870cfdd
- SHA512 649b72d91e8df156e05368295296a28bf2d725dd0b62d971623b428d5fb216ce0d7cb0f1c3be44964753ff36eeb4a6b12238dcbef665e21b30a8ad53f27fea54
- TLSH
  T14E0123E510353334ED635A443F9B200A5111DFFE65CCD95CC0D5F04FD6A8B9C10E0A24
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  klyc-pmm/scripts/pmm_distill.sh
- Size 10KB
- SHA256 c2dc61486f23ea8204664d4c54998ce07ed52af485fcd0d2963cbc04953931dc
- MD5 b3c5a86463547c3bef36f64f5ddeee16
- SHA1 7288b7e8ceb12c6eef83292c6a73eafdfdeab075
- SHA512 5a4bf6cd91edd7a3a33fd5ef3b426dafe2d1dd183ea6d654ef1d6d29657e7641bd61e89d5a4e0768d2c1629e18a21acaddf554da3cb84f986922be8504e92bd8
- SSDEEP 96:pyRDcgcIPB84rlLvldT7jz6Ym7QXI7q2A0dW2iqzJqZevzsieiZikf7i6bynzVEm:pyRwBOWt7+jFAz9AyeHzVOdV0b
- TLSH
  T12B2297AFBA7AACB030198C2CC1755C543546A00FD5252C763D1AA9FD4FB8E5CCCBD9A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  klyc-pmm/scripts/pmm_recover.sh
- Size 1KB
- SHA256 ddd5ac11987bc166db328a3bffb0ce35726591c9cd63b89069aa99b2bd994352
- MD5 fd1814791c1fdd0cbcfbeb4fd3b98408
- SHA1 df0c20431438506f9292fc265f77c76a7d61a9c4
- SHA512 202f5bb39d46bcf2576ab9e21fb3c8294f59f0e9be0988596a6d78693e8ec117ec3d54d63b9290767d0728d98ae900a75e493d07e1036003304ae1b0fda5e1b1
- TLSH
  T187311FD1BC2095326A6B8078624FA1C2B45545BF48886C2CB15FF4BD6FAD2607B782B7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral25 behavioral26 behavioral27 behavioral28
- Target
  klyc-pmm/scripts/pmm_watch.sh
- Size 62KB
- SHA256 f5fb7b6ba0a01e86c088469164bca0bf8daa43543c62df23ab1c3b9c669cc482
- MD5 61c5c38d22ddedd7f0f5af815d948f80
- SHA1 0a26d464a2e68be06ad1ae143a2923e4a8b42fad
- SHA512 b8536da6683d3ed3b8d0ebbcbf9a54ae3ae2a214c4bee1d34f31476d080c4771fc220424c45b578c94e701a7d86be853b8f5c3d97e6793f14365f00e2dd81bab
- SSDEEP 768:DSxCqGvsO5wJB2sXJMe1YZ9A33OuFT1hYQ1Uj563A5Jn/L6bKe8yDHa2ivbIrd4P:GM4Bpb3hZ2Qw5Jn/L5e8yDaIYZpB
- TLSH
  T1A9539335795185B03149DD3CAEFE98003119111BC1486C19B96FF6E82FBC76CFAFA2A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30 behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

OS Credential Dumping

Deletes log files

Write file to user bin folder

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32