General
- Target 5c73291f635f085e26acd3b0f9ed0e86192ad3bad1802f97e323b3db8c173199
- Size 55KB
- Sample260908-3lmc7syxft
- SHA256 5c73291f635f085e26acd3b0f9ed0e86192ad3bad1802f97e323b3db8c173199
Malware Config
Targets
-
- Target 5c73291f635f085e26acd3b0f9ed0e86192ad3bad1802f97e323b3db8c173199
- Size 55KB
- SHA256 5c73291f635f085e26acd3b0f9ed0e86192ad3bad1802f97e323b3db8c173199
Score7/10-
Executes dropped EXE
-
Modifies PAM framework files
Modifies Linux PAM framework files, possibly to intercept credentials.
-
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Deletes log files
Deletes log files on the system.
-
Modifies init.d
Adds/modifies system service, likely for persistence.
-
Write file to user bin folder
-
Writes file to system bin folder
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Modify Authentication Process
1Pluggable Authentication Modules
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Defense Evasion
Deobfuscate/Decode Files or Information
1Indicator Removal
1Clear Linux or Mac System Logs
1Modify Authentication Process
1Pluggable Authentication Modules
1Virtualization/Sandbox Evasion
1System Checks
1Credential Access
Modify Authentication Process
1Pluggable Authentication Modules
1OS Credential Dumping
1/etc/passwd and /etc/shadow
1