General
- Target d91614f54b08fdaf94b86b8e3c966fb09f33f8f91155e02ecd82ca5dc8134b16
- Size 1.6MB
- Sample260801-pyw7aabk2t
- SHA256 d91614f54b08fdaf94b86b8e3c966fb09f33f8f91155e02ecd82ca5dc8134b16
Malware Config
Targets
-
- Target d91614f54b08fdaf94b86b8e3c966fb09f33f8f91155e02ecd82ca5dc8134b16
- Size 1.6MB
- SHA256 d91614f54b08fdaf94b86b8e3c966fb09f33f8f91155e02ecd82ca5dc8134b16
Score9/10-
Modifies the dynamic linker configuration file
Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.
-
Renames itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
2Dynamic Linker Hijacking
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
2Dynamic Linker Hijacking
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
Hijack Execution Flow
2Dynamic Linker Hijacking
1Path Interception by PATH Environment Variable
1