Overview

overview

8

Static

static

1

3a2f5c1e96...436.sh

ubuntu-18.04-amd64

8

3a2f5c1e96...436.sh

debian-9-armhf

8

3a2f5c1e96...436.sh

debian-9-mips

3a2f5c1e96...436.sh

debian-9-mipsel

Sharing

Copy URL Twitter E-mail

General

  • Target
    3a2f5c1e963ce7d645e8c4b532d9dc494fbafff3f71a7c129817fdbe337aa436.sh
  • Size 843B
  • Sample260802-snwdsack31
  • SHA256 3a2f5c1e963ce7d645e8c4b532d9dc494fbafff3f71a7c129817fdbe337aa436
  • MD5 SHA1 SHA512 TLSH
Score
8/10
antivmcredential_accessdefense_evasiondiscoverylinuxpersistenceprivilege_escalation

Malware Config

Targets

    • Target
      3a2f5c1e963ce7d645e8c4b532d9dc494fbafff3f71a7c129817fdbe337aa436.sh
    • Size 843B
    • SHA256 3a2f5c1e963ce7d645e8c4b532d9dc494fbafff3f71a7c129817fdbe337aa436
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    antivmcredential_accessdefense_evasiondiscoverypersistenceprivilege_escalation

    • Adds new SSH keys

      Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

      persistenceprivilege_escalation

    • Modifies password files for system users/ groups

      Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

      persistencecredential_accessdefense_evasion

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

      defense_evasion

    • Executes dropped EXE

    • Modifies sudoers policy

      Writes to /etc/sudoers or a drop-in config, potentially granting passwordless root access to a user or process.

    • OS Credential Dumping

      Adversaries may attempt to dump credentials to use it in password cracking.

      credential_access

    • Checks system information (zLinux)

      Check system information on IBM zSystems which indicate if the system is a virtual machine.

      antivm

    • Removes the immutable protection flag from a file

      Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

    • Writes file to system bin folder

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

1
T1098

SSH Authorized Keys

1
T1098.004

Modify Authentication Process

1
T1556

Pluggable Authentication Modules

1
T1556.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Sudo and Sudo Caching

1
T1548.003

Account Manipulation

1
T1098

SSH Authorized Keys

1
T1098.004

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Sudo and Sudo Caching

1
T1548.003

File and Directory Permissions Modification

2
T1222

Linux and Mac File and Directory Permissions Modification

2
T1222.002

Modify Authentication Process

1
T1556

Pluggable Authentication Modules

1
T1556.003

Virtualization/Sandbox Evasion

2
T1497

System Checks

2
T1497.001

Credential Access

Modify Authentication Process

1
T1556

Pluggable Authentication Modules

1
T1556.003

OS Credential Dumping

1
T1003

/etc/passwd and /etc/shadow

1
T1003.008

Discovery

System Information Discovery

2
T1082

Virtualization/Sandbox Evasion

2
T1497

System Checks

2
T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks