Analysis
-
max time kernel
22128s -
max time network
156s -
platform
linux_amd64 -
resource
ubuntu-amd64 -
submitted
02-08-2021 18:37
General
-
Target
Linux.Encryptor
-
Size
2.0MB
-
MD5
3f9a28e8c057e7ea7ccf15a4db81f362
-
SHA1
10d6d3c957facf06098771bf409b9593eea58c75
-
SHA256
6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502
-
SHA512
58a71aeac247d206f023ee29aff81026881e41d3fbd268f7513e3bcd951701a68502361dd717befa79a094eb9fc0caaa9f8770ba83f5c94a8acb9ae0986ee386
Score
9/10
Malware Config
Signatures
-
Deletes system logs 1 TTPs 6 IoCs
-
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
-
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads CPU attributes 1 TTPs 1 IoCs
-
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
./Linux.Encryptor./Linux.Encryptor1⤵
- Writes file to tmp directory