Overview

overview

9

Static

static

94b59b4761...cb705f

linux_amd64

9

Analysis

  • max time kernel
    0s
  • max time network
    28s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • submitted
    17-02-2022 20:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f

  • Size

    611KB

  • MD5

    caeeadeea0762565473ac39681101c29

  • SHA1

    1f7aad5e0e5996ed5c6634d08066df13b7e01440

  • SHA256

    94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f

  • SHA512

    3c0a150894fc8a84a2b4ccaaa935fcfc74f07b16626f1ca82b34f743d5ee77bae2e4143b132721648275c4c3e7e5ac27687da16d25607d7ff3cab3ad1b1d74a4

Score
9/10
persistence

Malware Config

Signatures

  • Writes file to system bin folder 1 TTPs 3 IoCs
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  • Modifies rc script 1 TTPs 12 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Write file to user bin folder 1 TTPs 4 IoCs
  • Reads runtime system information 7 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • ./94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f
    ./94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f
    1⤵
      PID:576
    • /bin/chkconfig
      chkconfig --add 94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f
      1⤵
        PID:579
      • /sbin/chkconfig
        chkconfig --add 94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f
        1⤵
          PID:579
        • /usr/bin/chkconfig
          chkconfig --add 94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f
          1⤵
            PID:579
          • /usr/sbin/chkconfig
            chkconfig --add 94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f
            1⤵
              PID:579
            • /usr/local/bin/chkconfig
              chkconfig --add 94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f
              1⤵
                PID:579
              • /usr/local/sbin/chkconfig
                chkconfig --add 94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f
                1⤵
                  PID:579
                • /usr/X11R6/bin/chkconfig
                  chkconfig --add 94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f
                  1⤵
                    PID:579
                  • /bin/sh
                    sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
                    1⤵
                    • Creates/modifies Cron job
                    PID:582
                    • /bin/sed
                      sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
                      2⤵
                      • Creates/modifies Cron job
                      • Reads runtime system information
                      PID:583
                  • /bin/update-rc.d
                    update-rc.d 94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f defaults
                    1⤵
                      PID:581
                    • /sbin/update-rc.d
                      update-rc.d 94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f defaults
                      1⤵
                        PID:581
                      • /usr/bin/update-rc.d
                        update-rc.d 94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f defaults
                        1⤵
                          PID:581
                        • /usr/sbin/update-rc.d
                          update-rc.d 94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f defaults
                          1⤵
                          • Modifies rc script
                          • Write file to user bin folder
                          PID:581
                          • /bin/systemctl
                            systemctl daemon-reload
                            2⤵
                            • Reads runtime system information
                            PID:588
                        • /usr/bin/msrkmzekai
                          /usr/bin/msrkmzekai uptime 577
                          1⤵
                            PID:589
                          • /usr/bin/msrkmzekai
                            /usr/bin/msrkmzekai ifconfig 577
                            1⤵
                              PID:606
                            • /usr/bin/msrkmzekai
                              /usr/bin/msrkmzekai "cd /etc" 577
                              1⤵
                                PID:610
                              • /usr/bin/msrkmzekai
                                /usr/bin/msrkmzekai "ps -ef" 577
                                1⤵
                                  PID:613
                                • /usr/bin/msrkmzekai
                                  /usr/bin/msrkmzekai uptime 577
                                  1⤵
                                    PID:620
                                  • /usr/bin/toyvnyljqk
                                    /usr/bin/toyvnyljqk top 577
                                    1⤵
                                      PID:623
                                    • /usr/bin/toyvnyljqk
                                      /usr/bin/toyvnyljqk "cd /etc" 577
                                      1⤵
                                        PID:626
                                      • /usr/bin/toyvnyljqk
                                        /usr/bin/toyvnyljqk id 577
                                        1⤵
                                          PID:629
                                        • /usr/bin/toyvnyljqk
                                          /usr/bin/toyvnyljqk pwd 577
                                          1⤵
                                            PID:632
                                          • /usr/bin/toyvnyljqk
                                            /usr/bin/toyvnyljqk gnome-terminal 577
                                            1⤵
                                              PID:635
                                            • /usr/bin/pfdpxozpwp
                                              /usr/bin/pfdpxozpwp id 577
                                              1⤵
                                                PID:638
                                              • /usr/bin/pfdpxozpwp
                                                /usr/bin/pfdpxozpwp "ps -ef" 577
                                                1⤵
                                                  PID:641
                                                • /usr/bin/pfdpxozpwp
                                                  /usr/bin/pfdpxozpwp top 577
                                                  1⤵
                                                    PID:644
                                                  • /usr/bin/pfdpxozpwp
                                                    /usr/bin/pfdpxozpwp "echo \"find\"" 577
                                                    1⤵
                                                      PID:647
                                                    • /usr/bin/pfdpxozpwp
                                                      /usr/bin/pfdpxozpwp "ps -ef" 577
                                                      1⤵
                                                        PID:650
                                                      • /usr/bin/wneszxzwmm
                                                        /usr/bin/wneszxzwmm "ls -la" 577
                                                        1⤵
                                                          PID:653

                                                        Network

                                                        MITRE ATT&CK Enterprise v6

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads