Overview

overview

8

Static

static

1

preparar.sh

ubuntu-18.04-amd64

8

preparar.sh

debian-9-armhf

8

preparar.sh

debian-9-mips

8

preparar.sh

debian-9-mipsel

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    preparar.sh
  • Size 5KB
  • Sample260818-ppln7atvez
  • SHA256 488667a02eaf88aa7ce155eb0eaee42424e92e888ac39cb19efd826c3756a377
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverylinuxpersistenceprivilege_escalation

Malware Config

Targets

    • Target
      preparar.sh
    • Size 5KB
    • SHA256 488667a02eaf88aa7ce155eb0eaee42424e92e888ac39cb19efd826c3756a377
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoverypersistenceprivilege_escalation

    • Adds new SSH keys

      Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

      persistenceprivilege_escalation

    • Modifies sudoers policy

      Writes to /etc/sudoers or a drop-in config, potentially granting passwordless root access to a user or process.

    • Abuse Elevation Control Mechanism: Sudo and Sudo Caching

      Abuse sudo or cached sudo credentials to execute code.

      privilege_escalationdefense_evasion
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v16

Tasks