d38f077b96a00aae266c00f630a7153c6bb89e6cebeb33d328ec11efa3fdbeda

General

Target
main_powerpc
Size 994KB
Sample260908-ppmw9azgnf
SHA256 d38f077b96a00aae266c00f630a7153c6bb89e6cebeb33d328ec11efa3fdbeda
MD5 7745187f0c827acccc643c58d563de11
SHA1 b90abd763e2d77d344da63c3b6bd4c4f1a3d91c2
SHA512 f095619061a030eccbcc2f8c31ccfb5e9bec923c0b5dd7028d8c4279c9268ce67056dc6d6f25fc759f5b816cb0afd9ff0652860d7f12aee7e140ebfd60cb84a6
SSDEEP 24576:GDyb2e9eSNguR0PfZagyLAiymrKdWM8X9CWm5:deSNguypmLNtrUi9U
TLSH
T13C259E2AB2B3F2BDD007C03047DBDAA15531F0755A312D7B26C4DB383EAADA51359B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  main_powerpc
- Size 994KB
- SHA256 d38f077b96a00aae266c00f630a7153c6bb89e6cebeb33d328ec11efa3fdbeda
- MD5 7745187f0c827acccc643c58d563de11
- SHA1 b90abd763e2d77d344da63c3b6bd4c4f1a3d91c2
- SHA512 f095619061a030eccbcc2f8c31ccfb5e9bec923c0b5dd7028d8c4279c9268ce67056dc6d6f25fc759f5b816cb0afd9ff0652860d7f12aee7e140ebfd60cb84a6
- SSDEEP 24576:GDyb2e9eSNguR0PfZagyLAiymrKdWM8X9CWm5:deSNguypmLNtrUi9U
- TLSH
  T13C259E2AB2B3F2BDD007C03047DBDAA15531F0755A312D7B26C4DB383EAADA51359B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access defense_evasion discovery persistence
- Deletes Audit logs
  Deletes logs related to the Linux Audit framework.
  defense_evasion
- Deletes journal logs
  Deletes systemd journal logs. Likely to evade detection.
  defense_evasion
- Deletes system logs
  Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
  defense_evasion
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
- Modifies init.d
  Adds/modifies system service, likely for persistence.
  persistence
- Modifies rc script
  Adding/modifying system rc scripts is a common persistence mechanism.
  persistence
- Reads process memory
  Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
  credential_access
behavioral1