Perl base64 installer spawned from SSH session after sudo check (Ebury)

ills3c Intel&Coffee@Ills3C

•updated today•0•0•3

Detects a sequence of events on a Linux device where a sudo command execution is followed within 15 minutes by a Perl process executing base64 decoding commands within the same SSH session.