General
- Target 80729e37f797da2b5a177867306318626e52b675f44fa441c256d139e88f69df.sh
- Size 8KB
- Sample260913-wref8atwcv
- SHA256 80729e37f797da2b5a177867306318626e52b675f44fa441c256d139e88f69df
Malware Config
Targets
-
- Target 80729e37f797da2b5a177867306318626e52b675f44fa441c256d139e88f69df.sh
- Size 8KB
- SHA256 80729e37f797da2b5a177867306318626e52b675f44fa441c256d139e88f69df
Score8/10-
Detects GOST tunneling tool
A simple tunneling tool written in Golang
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Reverse proxy tool: FRP aka Fast Reverse Proxy
FRP (Fast Reverse Proxy) can be abused to bypass network security and establish persistent backdoors. This open-source utility tunnels traffic through a public server to expose internal services behind NAT or firewalls.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Privilege Escalation
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1