ac04dbc126c3961657280b82dcccc728d5ffd3486ab5c8b6401c4bea84a7315e

General

Target
9e1ebff427d91089e7459f3dbad6c350
Size 1.1MB
Sample211208-m5n35scfc9
SHA256 ac04dbc126c3961657280b82dcccc728d5ffd3486ab5c8b6401c4bea84a7315e
MD5 9e1ebff427d91089e7459f3dbad6c350
SHA1 c15c9e17b3a2cd39c0b43034c9928d30ab22ff2f
SHA512 92107c3ee288d68b147fa13e6142f47d4c0a86df99de14b5a3e80b0f35f1544cde366a7c9657807e20d248ac6be7aad41e881f0f0dd327d36f442d22d5797094
MD5 SHA1 SHA512

Score

9^/10

antivm persistence

Malware Config

Signatures

Attempts to identify hypervisor via CPU configuration 1 TTPs 1 IoCs

Checks CPU information for indicators that the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
/proc/cpuinfo	/proc/cpuinfo

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
/etc/init.d/boot.local	/etc/init.d/boot.local	sed

Modifies rc script 1 TTPs 4 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
/etc/rc.d/rc.local	/etc/rc.d/rc.local	sed
/etc/rc.local	/etc/rc.local	sed
/etc/rc.local	/etc/rc.local	sed
/etc/rc.local	/etc/rc.local	sed

Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
/proc/net/dev	/proc/net/dev

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	sed
/proc/stat	/proc/stat	Process not Found
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	sed

./9e1ebff427d91089e7459f3dbad6c350
./9e1ebff427d91089e7459f3dbad6c350
1⤵
PID:322
- /bin/sh
  sh -c "sed -i -e '/exit/d' /etc/rc.local"
  2⤵
  PID:323
- - /bin/sed
    sed -i -e /exit/d /etc/rc.local
    3⤵
    - Modifies rc script
    - Reads runtime system information
    PID:324
- /bin/sh
  sh -c "sed -i -e '/^ | | \$/d' /etc/rc.local"
  2⤵
  PID:329
- - /bin/sed
    sed -i -e "/^ | | \$/d" /etc/rc.local
    3⤵
    - Reads runtime system information
    PID:330
- /bin/sh
  sh -c "sed -i -e '/9e1ebff427d91089e7459f3dbad6c350 reboot/d' /etc/rc.local"
  2⤵
  PID:331
- - /bin/sed
    sed -i -e "/9e1ebff427d91089e7459f3dbad6c350 reboot/d" /etc/rc.local
    3⤵
    - Modifies rc script
    - Reads runtime system information
    PID:332
- /bin/sh
  sh -c "sed -i -e '2 i/tmp/9e1ebff427d91089e7459f3dbad6c350 reboot' /etc/rc.local"
  2⤵
  PID:333
- - /bin/sed
    sed -i -e "2 i/tmp/9e1ebff427d91089e7459f3dbad6c350 reboot" /etc/rc.local
    3⤵
    - Modifies rc script
    - Reads runtime system information
    PID:334
- /bin/sh
  sh -c "sed -i -e '2 i/tmp/9e1ebff427d91089e7459f3dbad6c350 reboot start' /etc/rc.d/rc.local"
  2⤵
  PID:335
- - /bin/sed
    sed -i -e "2 i/tmp/9e1ebff427d91089e7459f3dbad6c350 reboot start" /etc/rc.d/rc.local
    3⤵
    - Modifies rc script
    - Reads runtime system information
    PID:336
- /bin/sh
  sh -c "sed -i -e '2 i/tmp/9e1ebff427d91089e7459f3dbad6c350 reboot start' /etc/init.d/boot.local"
  2⤵
  PID:337
- - /bin/sed
    sed -i -e "2 i/tmp/9e1ebff427d91089e7459f3dbad6c350 reboot start" /etc/init.d/boot.local
    3⤵
    - Modifies init.d
    - Reads runtime system information
    PID:338