Overview

overview

8

Static

static

1

OmniRCM-linux-x64

ubuntu-18.04-amd64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    OmniRCM-linux-x64
  • Size 101.7MB
  • Sample261110-2wtpladx4v
  • SHA256 66c6a0295db8525e8bee045e9a63467cddca297812cd1539de8b03acfe592d39
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
antivmcredential_accessdefense_evasiondiscoveryexecutionlinuxpersistenceprivilege_escalation

Malware Config

Targets

    • Target
      OmniRCM-linux-x64
    • Size 101.7MB
    • SHA256 66c6a0295db8525e8bee045e9a63467cddca297812cd1539de8b03acfe592d39
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    antivmcredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation
    behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

User Execution

2
T1204

Malicious File

1
T1204.002

Persistence

Boot or Logon Autostart Execution

1
T1547

XDG Autostart Entries

1
T1547.013

Modify Authentication Process

1
T1556

Pluggable Authentication Modules

1
T1556.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Sudo and Sudo Caching

1
T1548.003

Boot or Logon Autostart Execution

1
T1547

XDG Autostart Entries

1
T1547.013

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Sudo and Sudo Caching

1
T1548.003

Modify Authentication Process

1
T1556

Pluggable Authentication Modules

1
T1556.003

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Credential Access

Modify Authentication Process

1
T1556

Pluggable Authentication Modules

1
T1556.003

OS Credential Dumping

1
T1003

/etc/passwd and /etc/shadow

1
T1003.008

Discovery

System Information Discovery

2
T1082

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks