c8681f716f704a21438772f8f362641065a6450caeb70e40cdd8e38dcc6c2477

Sharing

Copy URL Twitter E-mail

General

Target
tsimx28-usb-image-replicator-rootfs-20220302.tar.xz
Size 14.3MB
Sample261006-25mmmsg15v
SHA256 c8681f716f704a21438772f8f362641065a6450caeb70e40cdd8e38dcc6c2477
MD5 bd683e79d92f26793973aeecb2054640
SHA1 03e6946cf6d6aea3b4dc84ba2d2d56024c5ce2e3
SHA512 0be7e399ba800e840cb75dbbee47849a2efd61a0271a0d4681f25b6d272d47029b35a2a797add250fb561d40236ec82220873f47430a1917a173509be0ac6e7f
SSDEEP 393216:NZmIyn8iNH9d94I4Fy9qma+uDblS4TwCQDesWwxp4:+L/H9Qpg9qmTkom9QJxxp4
TLSH
T121E63396EFD84952D8F03AE688FCA19512FF0456C38AC457BF2741EC35162BF0A6847E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  blast.sh
- Size 5KB
- SHA256 dcdd2596880495ae4a3bcac0f9e48b4797be1b106fa916864aad2703f479d7eb
- MD5 5cb8581072463048f2efb897002c8828
- SHA1 5f32058a0150556eafe19ff40f4d98f2a95e0bc8
- SHA512 63fd073af55cab560f1d8ed7a2eacd07f03fe8b076aaeef3bd1cbc6d881a26e1305ca8fbd983820d9e5984e152dbe4dabfb3dc71b6c4c978a53c1efab66c5a24
- SSDEEP 96:qBWvs3iUkd5nyUSgrhG8mSXC+t3LZejxIR6EWbVEwh:qBWvs3i5dTDheNEbZqQ6REwh
- TLSH
  T1AFB17811B1E497B632A7D2893ECF91097D1D803017B1A7E4A44DE126EBA0F39E1397DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  blast_funcs.sh
- Size 11KB
- SHA256 d0f02a6563dc5fc43fe52989a3f851b7192e5a1794badf95605e36f63e806447
- MD5 34bc8eb3efcb2de4a53faee7233505d4
- SHA1 39d30f425c97243d05fff9e281a67d36dcd959a7
- SHA512 75b229966f847cd4fa92bec9911c4981792f460a5b4615b78956839f12c797adc68e6c307889a4374f31f6666fd76c40dfb440460ec1e61c9089122df2db2359
- SSDEEP 192:5ZBC7ZA4zvVD2hxPbo7GWKyGDqJ+Ap1qAjmahOXobF:5ZmWuqhxjoyWKLQBvmAfF
- TLSH
  T16732A616714FF27D035301AA7A2E41C7963C802DD2729688F14DD659637CA39C7BAFB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  sanitize_linux_rootfs.sh
- Size 2KB
- SHA256 ea9d244f8251a9dff103f38eedf3ae44b9e558aa39adc3e37adc497b6972107e
- MD5 d144982f762816722983e29821813943
- SHA1 e91473ee093c169982cd1d38c3ce36a8adb927aa
- SHA512 f638181240fb5f2cc4176505627c32deff96752b71fa8ee8cbe9c83c1cb75fa2d40365ed2dea64bef1913f1fcc0efed4231cda5d1ec98d5bfb75e825599ec6af
- TLSH
  T1DF517805358965DF0DC221FD7B1DB334A2E7A00EE379264034CA61A4A3BA5DD73B7B51
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery privilege_escalation
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Deletes Audit logs
  Deletes logs related to the Linux Audit framework.
  defense_evasion
- Deletes journal logs
  Deletes systemd journal logs. Likely to evade detection.
  defense_evasion
- Deletes system logs
  Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
  defense_evasion
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Reads network interface configuration
  Fetches information about one or more active network interfaces.
  discovery
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  tsinit
- Size 1KB
- SHA256 278447dba32fc520bfb4517b5dcb6376bf95248e5e70c9f9263ad0458c485895
- MD5 2a60d7b1c55471617d72242e13aa31d1
- SHA1 6cc934c9e52e6dbf8e4d178857e0cf7cf3fa20a8
- SHA512 236a4f710d47219dd5d35c5632869f2d4c4c867f2ea962174a89940982febc02283cdbce8f3e5fdecbfadd49af3f6bdd810fa3a8e56c4b9990620ea0f185f023
- TLSH
  T1FC1123A1ABBC2AFF004A03AA3FAEE0DD0E4F0454A5F6DED12DC3586067685A45379F50
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  tsinit.scr
- Size 484B
- SHA256 c3498e0335b9c808f6624bff98b2f1e207163e9fe29efd7d32fd4f33f66ecc75
- MD5 d0df938be7b967cdefdcf683ef4bef75
- SHA1 bd3faaa151f96dec092d7bd8d87a08ca5ab8f1e5
- SHA512 82e0c5c8053436f360ecf5e410124fa27b680d470b6caf46c8500d8693991f8c6820111b72b1ff0adea2750b960db24facfd9f2d111782e287dd57d4693a62c6
- TLSH
  T195F0978C2FFB9C71E915AC72B6B1BA28D540B82328F5A67A14C0639CD00EEDCC920150
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17 behavioral18
- Target
  tsinit.source
- Size 412B
- SHA256 741326b9c8b4629a653388b3933499f402ec3c1990335d39dfb9819240f834e4
- MD5 5690459d716145d026a2528a9a548dfd
- SHA1 afd5173ddc8dfc665b755be3b206c2bae823c409
- SHA512 0bcd27d7ab59aae586725316332a6b1e68f661794fef059b957d2cc3bf201b6d974f863b0283d6d9466b560b051ba421a4c771e5d483596ae66f2fe67e60001b
- TLSH
  T12AE055982FFB9CB1EA55BC62B1F1B8249941B92328F1A67A10C0639CD44EEDCC520550
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral19 behavioral20
- Target
  tsinit.ub
- Size 484B
- SHA256 c3498e0335b9c808f6624bff98b2f1e207163e9fe29efd7d32fd4f33f66ecc75
- MD5 d0df938be7b967cdefdcf683ef4bef75
- SHA1 bd3faaa151f96dec092d7bd8d87a08ca5ab8f1e5
- SHA512 82e0c5c8053436f360ecf5e410124fa27b680d470b6caf46c8500d8693991f8c6820111b72b1ff0adea2750b960db24facfd9f2d111782e287dd57d4693a62c6
- TLSH
  T195F0978C2FFB9C71E915AC72B6B1BA28D540B82328F5A67A14C0639CD00EEDCC920150
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

File and Directory Permissions Modification

Deletes Audit logs

Deletes journal logs

Deletes system logs

Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Deletes log files

Reads network interface configuration

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22