General
- Target setup.sh
- Size 1KB
- Sample261107-3j9eyswtby
- SHA256 f676615eba6599c10ec4391479299ea3eeb430b5af60251a62756fa8f6a3d9c4
Score
8/10
Malware Config
Targets
-
- Target setup.sh
- Size 1KB
- SHA256 f676615eba6599c10ec4391479299ea3eeb430b5af60251a62756fa8f6a3d9c4
Score8/10Modifies password files for system users/ groups
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
Loads a kernel module
Loads a Linux kernel module, potentially to achieve persistence
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Abuse sudo or cached sudo credentials to execute code.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
MITRE ATT&CK Enterprise v16
Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Modify Authentication Process
1Pluggable Authentication Modules
1