Extracted

• • Target
    964ad06953d28bff625b49a6f90a721d13eda1128f9098ad0e2586931da6274c.sh
  • Size 1KB
  • SHA256 964ad06953d28bff625b49a6f90a721d13eda1128f9098ad0e2586931da6274c
  • MD5 a9ff4560ca5617b60ddd09ce0d1433f4
  • SHA1 a6cd3963c95780eff7592998f722fd0b45a69bf2
  • SHA512 b5a5e1af3b1c0c287cae486df6fdff1323fb8d8afc898acb514b8a34a973f2cffa5124154f52678d71442c02a9224a06e86525d80504c8d294203bea5c686afc
  • TLSH
    T14D2121C124D23B7FCDE955263706243D216D69CA2E2F1BC8D8DA65E8E3852C2F150D4C
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscovery

  • Contacts a large (84879) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Renames itself

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1behavioral2behavioral3behavioral4