General
- Target 3ee853adc6a47a00eb9a56b519a5d80dd65b6bd0f8e7682ae71d903cec7e5fcd
- Size 21KB
- Sample260903-ranw4sycpc
- SHA256 3ee853adc6a47a00eb9a56b519a5d80dd65b6bd0f8e7682ae71d903cec7e5fcd
Malware Config
Targets
-
- Target 3ee853adc6a47a00eb9a56b519a5d80dd65b6bd0f8e7682ae71d903cec7e5fcd
- Size 21KB
- SHA256 3ee853adc6a47a00eb9a56b519a5d80dd65b6bd0f8e7682ae71d903cec7e5fcd
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Write file to user bin folder
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Virtualization/Sandbox Evasion
1System Checks
1