Overview

overview

10

Static

static

10

7f0c9c24f2...dfd49c

linux_amd64

10

7f0c9c24f2...dfd49c

linux_mipsel

7f0c9c24f2...dfd49c

linux_mips

Analysis

  • max time kernel
    21548s
  • max time network
    213s
  • platform
    linux_amd64
  • resource
    ubuntu-amd64
  • submitted
    27/07/2021, 01:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7f0c9c24f2bd4145e923fe65bcdfd49c

  • Size

    1.2MB

  • MD5

    7f0c9c24f2bd4145e923fe65bcdfd49c

  • SHA1

    ee482d0f762f102a86bd500c16b2586d3d20795c

  • SHA256

    7fd819ff6a69b045b0d7eb9900987dff73792a68acaa45cb0e2ef9298c5bba54

  • SHA512

    33a3ce0ee73f7ee07cb39955a8c29649578b4e38dbcd9d442dff725b97896bda1ba73bd816955f48c562925345c8790ec976a0b4e5a6cf1f93b2f2e91199b186

Score
10/10
suricata

Malware Config

Signatures

  • suricata: ET MALWARE Linux/BillGates Checkin Response
    suricata
  • Writes file to system bin folder 1 TTPs 4 IoCs
  • Write file to user bin folder 1 TTPs 12 IoCs
  • Reads runtime system information 21 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 5 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • ./7f0c9c24f2bd4145e923fe65bcdfd49c
    ./7f0c9c24f2bd4145e923fe65bcdfd49c
    1⤵
      PID:688
    • /bin/ln
      ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
      1⤵
        PID:695
      • /bin/ln
        ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
        1⤵
          PID:697
        • /bin/ln
          ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
          1⤵
            PID:699
          • /bin/ln
            ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
            1⤵
              PID:701
            • /bin/ln
              ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
              1⤵
                PID:703
              • /bin/mkdir
                mkdir -p /usr/bin/bsd-port
                1⤵
                • Reads runtime system information
                PID:705
              • /bin/mkdir
                mkdir -p /usr/bin/bsd-port
                1⤵
                • Reads runtime system information
                PID:707
              • /bin/cp
                cp -f /tmp/7f0c9c24f2bd4145e923fe65bcdfd49c /usr/bin/bsd-port/getty
                1⤵
                • Write file to user bin folder
                • Reads runtime system information
                • Writes file to tmp directory
                PID:709
              • /usr/bin/bsd-port/getty
                /usr/bin/bsd-port/getty
                1⤵
                  PID:712
                • /bin/mkdir
                  mkdir -p /usr/bin
                  1⤵
                  • Reads runtime system information
                  PID:715
                • /bin/mkdir
                  mkdir -p /usr/bin
                  1⤵
                  • Reads runtime system information
                  PID:717
                • /bin/cp
                  cp -f /tmp/7f0c9c24f2bd4145e923fe65bcdfd49c /usr/bin/.sshd
                  1⤵
                  • Write file to user bin folder
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:719
                • /bin/ln
                  ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
                  1⤵
                    PID:721
                  • /bin/ln
                    ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
                    1⤵
                      PID:723
                    • /usr/bin/.sshd
                      /usr/bin/.sshd
                      1⤵
                        PID:726
                      • /bin/ln
                        ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
                        1⤵
                          PID:728
                        • /bin/ln
                          ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
                          1⤵
                            PID:730
                          • /bin/ln
                            ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
                            1⤵
                              PID:732
                            • /bin/mkdir
                              mkdir -p /usr/bin/dpkgd
                              1⤵
                              • Reads runtime system information
                              PID:734
                            • /bin/cp
                              cp -f /bin/ps /usr/bin/dpkgd/ps
                              1⤵
                              • Writes file to system bin folder
                              • Write file to user bin folder
                              • Reads runtime system information
                              PID:736
                            • /bin/mkdir
                              mkdir -p /bin
                              1⤵
                              • Reads runtime system information
                              PID:738
                            • /bin/mkdir
                              mkdir -p /bin
                              1⤵
                              • Reads runtime system information
                              PID:740
                            • /bin/cp
                              cp -f /usr/bin/bsd-port/getty /bin/ps
                              1⤵
                              • Writes file to system bin folder
                              • Write file to user bin folder
                              • Reads runtime system information
                              PID:742
                            • /bin/chmod
                              chmod 0755 /bin/ps
                              1⤵
                                PID:744
                              • /bin/cp
                                cp -f /bin/ss /usr/bin/dpkgd/ss
                                1⤵
                                • Writes file to system bin folder
                                • Write file to user bin folder
                                • Reads runtime system information
                                PID:746
                              • /bin/mkdir
                                mkdir -p /bin
                                1⤵
                                • Reads runtime system information
                                PID:748
                              • /bin/mkdir
                                mkdir -p /bin
                                1⤵
                                • Reads runtime system information
                                PID:750
                              • /bin/cp
                                cp -f /usr/bin/bsd-port/getty /bin/ss
                                1⤵
                                • Writes file to system bin folder
                                • Write file to user bin folder
                                • Reads runtime system information
                                PID:752
                              • /bin/chmod
                                chmod 0755 /bin/ss
                                1⤵
                                  PID:754
                                • /bin/cp
                                  cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
                                  1⤵
                                  • Write file to user bin folder
                                  • Reads runtime system information
                                  PID:756
                                • /bin/mkdir
                                  mkdir -p /usr/bin
                                  1⤵
                                  • Reads runtime system information
                                  PID:758
                                • /bin/mkdir
                                  mkdir -p /usr/bin
                                  1⤵
                                  • Reads runtime system information
                                  PID:760
                                • /bin/cp
                                  cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
                                  1⤵
                                  • Write file to user bin folder
                                  • Reads runtime system information
                                  PID:762
                                • /bin/chmod
                                  chmod 0755 /usr/bin/lsof
                                  1⤵
                                    PID:764
                                  • /sbin/insmod
                                    insmod /usr/bin/bsd-port/xpacket.ko
                                    1⤵
                                    • Reads runtime system information
                                    PID:768
                                  • /sbin/insmod
                                    insmod /tmp/xpacket.ko
                                    1⤵
                                    • Reads runtime system information
                                    PID:779

                                  Network

                                  MITRE ATT&CK Enterprise v6

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads