General
- Target 9a59b9faebdde2a6bb88f3ab0f8b8adc030d534d96a08bc0a1dbbf6b9fcbe56d.zip
- Size 1KB
- Sample261113-sqa6mac16k
- SHA256 9dd46c6f3c64e6f8ebffe60ff15a9aac000fbb8c732fce713266f4ebb49bc6e1
Score
8/10
Malware Config
Targets
-
- Target 9a59b9faebdde2a6bb88f3ab0f8b8adc030d534d96a08bc0a1dbbf6b9fcbe56d.sh
- Size 2KB
- SHA256 9a59b9faebdde2a6bb88f3ab0f8b8adc030d534d96a08bc0a1dbbf6b9fcbe56d
Score8/10Adds new SSH keys
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
Modifies password files for system users/ groups
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
Loads a kernel module
Loads a Linux kernel module, potentially to achieve persistence
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
Adds a user to the system
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1SSH Authorized Keys
1Boot or Logon Autostart Execution
1XDG Autostart Entries
1Modify Authentication Process
1Pluggable Authentication Modules
1Privilege Escalation
Account Manipulation
1SSH Authorized Keys
1Boot or Logon Autostart Execution
1XDG Autostart Entries
1