Overview

overview

7

Static

static

1

ps_Q4huLTcs.ps1.sh

ubuntu-18.04-amd64

7

ps_Q4huLTcs.ps1.sh

debian-9-armhf

7

ps_Q4huLTcs.ps1.sh

debian-9-mips

7

ps_Q4huLTcs.ps1.sh

debian-9-mipsel

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    ps_Q4huLTcs.ps1.sh
  • Size 86KB
  • Sample260901-r8bz7seq4z
  • SHA256 407156dcc6b97cb70efde9994f8e6ff8cfd2c9cd7e4f3d179f39edacd4d557d5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
antivmdefense_evasiondiscoveryexecutionlinuxprivilege_escalation

Malware Config

Targets

    • Target
      ps_Q4huLTcs.ps1.sh
    • Size 86KB
    • SHA256 407156dcc6b97cb70efde9994f8e6ff8cfd2c9cd7e4f3d179f39edacd4d557d5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasiondiscoveryexecutionprivilege_escalationantivm

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

      defense_evasion

    • Abuse Elevation Control Mechanism: Sudo and Sudo Caching

      Abuse sudo or cached sudo credentials to execute code.

      privilege_escalationdefense_evasion

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

      discovery

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

JavaScript

1
T1059.007

Unix Shell

1
T1059.004

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Sudo and Sudo Caching

1
T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Sudo and Sudo Caching

1
T1548.003

Deobfuscate/Decode Files or Information

1
T1140

File and Directory Permissions Modification

1
T1222

Linux and Mac File and Directory Permissions Modification

1
T1222.002

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Credential Access

Discovery

Process Discovery

1
T1057

System Information Discovery

2
T1082

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

1
T1016.001

System Network Connections Discovery

1
T1049

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks