General
- Target install.tgz
- Size 34KB
- Sample260830-w1m5qayzcv
- SHA256 d91701e62fc85c7bf75a29c5878a874f68af16207eae3dff8f3e771a6b7ac297
Malware Config
Targets
-
- Target crontab
- Size 336B
- SHA256 4936c6eb00a2ae750bd75b4a0e63755f7324246ef6fd95921eac77fdd6242aa5
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
- Target execute
- Size 543B
- SHA256 08358d066e0d757582926ff181e0d2ad647e6bd50816db9ead0e59f95184d565
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
- Target install
- Size 4KB
- SHA256 f84813b68b682f38ebefef9ad08155883cfb2a5ce3cabe41d5140d0b87da48e5
Score10/10-
Detects Kaiten/Tsunami payload
-
Family: Kaiten,Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
-
Adds new SSH keys
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
-
Modifies password files for system users/ groups
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
Modifies sudoers policy
Writes to /etc/sudoers or a drop-in config, potentially granting passwordless root access to a user or process.
-
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
-
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Abuse sudo or cached sudo credentials to execute code.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
Write file to user bin folder
-
Writes file to system bin folder
-
- Target netstat
- Size 422B
- SHA256 a6a8ced5f7336ac5e94b1fa49520a4048c001796fa7365489ce54c65fab67b34
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
- Target top
- Size 129B
- SHA256 eea10a99d7818c3c2e11db4df45249e08c73500f4f27d306780f4e45f1f8b57a
Score1/10 -
- Target whereis
- Size 343B
- SHA256 da4efe5a15a881b8abd06ac73721830dcf0e953972a40b670c84d3727af273e1
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1SSH Authorized Keys
1Modify Authentication Process
1Pluggable Authentication Modules
1Scheduled Task/Job
1Cron
1Privilege Escalation
Abuse Elevation Control Mechanism
2Sudo and Sudo Caching
2Account Manipulation
1SSH Authorized Keys
1Scheduled Task/Job
1Cron
1Defense Evasion
Abuse Elevation Control Mechanism
2Sudo and Sudo Caching
2File and Directory Permissions Modification
2Linux and Mac File and Directory Permissions Modification
2Modify Authentication Process
1Pluggable Authentication Modules
1