General
- Target ac619a5cba97b835cf875b44ce8486f147c66aa63fbd4990ad77a3b5017a147f.sh
- Size 1KB
- Sample260817-slchwsshqf
- SHA256 ac619a5cba97b835cf875b44ce8486f147c66aa63fbd4990ad77a3b5017a147f
Malware Config
Targets
-
- Target ac619a5cba97b835cf875b44ce8486f147c66aa63fbd4990ad77a3b5017a147f.sh
- Size 1KB
- SHA256 ac619a5cba97b835cf875b44ce8486f147c66aa63fbd4990ad77a3b5017a147f
Score9/10-
Contacts a large (600283) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Deletes itself
-
Executes dropped EXE
-
Loads a kernel module
Loads a Linux kernel module, potentially to achieve persistence
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies init.d
Adds/modifies system service, likely for persistence.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Unix Shell
1Scheduled Task/Job
1Cron
1Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1