ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4

Resubmissions

30-06-2021 16:31

210630-v7kg8l625j 10

28-06-2021 22:28

210628-nmx97k3rnn 10

Analysis

max time kernel
19118s
max time network
156s
platform
linux_amd64
resource
ubuntu-amd64
submitted
28-06-2021 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4.bin
Size

102KB
MD5

395249d3e6dae1caff6b5b2e1f75bacd
SHA1

29f16c046a344e0d0adfea80d5d7958d6b6b8cfa
SHA256

ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4
SHA512

54bf867c030f708eb0975825d7c8e4c1b3bca49451bc08ebc3bb9fbd10e9ffdce82332ca200ee960b8ce7dfee1247e52c4ca11041cd976aa7cee6d4957144714

Score

6^/10

Malware Config

Signatures

Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery
T1082

Processes:

pkill

description ioc process

/sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill

description	ioc	process
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pkill

description	ioc	process
/proc/190/status	/proc/190/status	pkill
/proc/370/status	/proc/370/status	pkill
/proc/31/cmdline	/proc/31/cmdline	pkill
/proc/34/cmdline	/proc/34/cmdline	pkill
/proc/78/status	/proc/78/status	pkill
/proc/81/cmdline	/proc/81/cmdline	pkill
/proc/3/status	/proc/3/status	pkill
/proc/4/cmdline	/proc/4/cmdline	pkill
/proc/14/cmdline	/proc/14/cmdline	pkill
/proc/30/status	/proc/30/status	pkill
/proc/155/status	/proc/155/status	pkill
/proc/249/status	/proc/249/status	pkill
/proc/343/status	/proc/343/status	pkill
/proc/648/cmdline	/proc/648/cmdline	pkill
/proc/27/cmdline	/proc/27/cmdline	pkill
/proc/160/cmdline	/proc/160/cmdline	pkill
/proc/416/status	/proc/416/status	pkill
/proc/9/status	/proc/9/status	pkill
/proc/15/status	/proc/15/status	pkill
/proc/20/cmdline	/proc/20/cmdline	pkill
/proc/22/cmdline	/proc/22/cmdline	pkill
/proc/352/cmdline	/proc/352/cmdline	pkill
/proc/387/status	/proc/387/status	pkill
/proc/666/cmdline	/proc/666/cmdline	pkill
/proc/11/status	/proc/11/status	pkill
/proc/28/cmdline	/proc/28/cmdline	pkill
/proc/152/cmdline	/proc/152/cmdline	pkill
/proc/163/status	/proc/163/status	pkill
/proc/17/status	/proc/17/status	pkill
/proc/21/status	/proc/21/status	pkill
/proc/153/status	/proc/153/status	pkill
/proc/165/cmdline	/proc/165/cmdline	pkill
/proc/237/cmdline	/proc/237/cmdline	pkill
/proc/18/cmdline	/proc/18/cmdline	pkill
/proc/19/cmdline	/proc/19/cmdline	pkill
/proc/23/status	/proc/23/status	pkill
/proc/159/cmdline	/proc/159/cmdline	pkill
/proc/644/cmdline	/proc/644/cmdline	pkill
/proc/1/status	/proc/1/status	pkill
/proc/8/status	/proc/8/status	pkill
/proc/33/status	/proc/33/status	pkill
/proc/345/status	/proc/345/status	pkill
/proc/156/cmdline	/proc/156/cmdline	pkill
/proc/250/status	/proc/250/status	pkill
/proc/387/cmdline	/proc/387/cmdline	pkill
/proc/14/status	/proc/14/status	pkill
/proc/19/status	/proc/19/status	pkill
/proc/35/status	/proc/35/status	pkill
/proc/79/status	/proc/79/status	pkill
/proc/25/status	/proc/25/status	pkill
/proc/82/cmdline	/proc/82/cmdline	pkill
/proc/156/status	/proc/156/status	pkill
/proc/667/status	/proc/667/status	pkill
/proc/3/cmdline	/proc/3/cmdline	pkill
/proc/4/status	/proc/4/status	pkill
/proc/11/cmdline	/proc/11/cmdline	pkill
/proc/13/status	/proc/13/status	pkill
/proc/80/cmdline	/proc/80/cmdline	pkill
/proc/164/cmdline	/proc/164/cmdline	pkill
/proc/656/cmdline	/proc/656/cmdline	pkill
/proc/25/cmdline	/proc/25/cmdline	pkill
/proc/31/status	/proc/31/status	pkill
/proc/97/cmdline	/proc/97/cmdline	pkill
/proc/370/cmdline	/proc/370/cmdline	pkill

./ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4.bin
./ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4.bin
1⤵
PID:659
- "" "" ""
  2⤵
  PID:660
- - /bin/uname
    uname -a
    3⤵
    PID:661
- - /bin/hostname
    hostname
    3⤵
    PID:662
- "" "" ""
  2⤵
  PID:663
- - /bin/uname
    uname -a
    3⤵
    PID:664
- - /bin/hostname
    hostname
    3⤵
    PID:665
- "" "" "pkill -9 vmx-*"
  2⤵
  PID:666
- - /usr/bin/pkill
    pkill -9 "vmx-*"
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:667
- "" "" ""
  2⤵
  PID:668
- - /usr/bin/awk
    awk -F "\"*,\"*" "{system(\"esxcli vm process kill --type=force --world-id=\" \$1)}"
    3⤵
    PID:670

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads