Analysis
-
max time kernel
0s -
max time network
27s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
submitted
17-02-2022 20:43
Static task
static1
Behavioral task
behavioral1
Sample
46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0
-
Size
611KB
-
MD5
757b89c6cc5a910c11a555a381684e55
-
SHA1
5cd2b55e20d10dd6bdd9bd972aad67ef7544d4ce
-
SHA256
46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0
-
SHA512
0a9ecca06f87e403e7170dcb3fa275547139f9ee4b253efdd96f01d2d806b49d78a1ebf8bf420c156d9cbf74dc652c180b6591de2c5f34d5902f0e64cf45bd1f
Malware Config
Signatures
-
Writes file to system bin folder 1 TTPs 3 IoCs
Processes:
description ioc /bin/vskimiglrc /bin/vskimiglrc /bin/topjjpjuth /bin/topjjpjuth /bin/xepsezytei /bin/xepsezytei -
Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
sedshdescription ioc process /etc/crontab /etc/crontab sed /etc/crontab /etc/crontab sh -
Modifies rc script 1 TTPs 12 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
Processes:
update-rc.ddescription ioc /etc/rc4.d/S9046b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0 /etc/rc4.d/S9046b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0 /etc/rc5.d/S9046b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0 /etc/rc5.d/S9046b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0 /etc/rc0.d/ /etc/rc0.d/ update-rc.d /etc/rc5.d/ /etc/rc5.d/ update-rc.d /etc/rc4.d/ /etc/rc4.d/ update-rc.d /etc/rc3.d/ /etc/rc3.d/ update-rc.d /etc/rc2.d/ /etc/rc2.d/ update-rc.d /etc/rc2.d/S9046b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0 /etc/rc2.d/S9046b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0 /etc/rc3.d/S9046b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0 /etc/rc3.d/S9046b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0 /etc/rc6.d/ /etc/rc6.d/ update-rc.d /etc/rc1.d/ /etc/rc1.d/ update-rc.d /etc/rc1.d/S9046b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0 /etc/rc1.d/S9046b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0 -
Write file to user bin folder 1 TTPs 4 IoCs
Processes:
update-rc.ddescription ioc process /usr/sbin/update-rc.d /usr/sbin/update-rc.d update-rc.d /usr/bin/vskimiglrc /usr/bin/vskimiglrc /usr/bin/topjjpjuth /usr/bin/topjjpjuth /usr/bin/xepsezytei /usr/bin/xepsezytei -
Reads runtime system information 7 IoCs
Reads data from /proc virtual filesystem.
Processes:
systemctlseddescription ioc process /proc/self/stat /proc/self/stat systemctl /proc/sys/kernel/osrelease /proc/sys/kernel/osrelease systemctl /proc/1/environ /proc/1/environ systemctl /proc/1/sched /proc/1/sched systemctl /proc/cmdline /proc/cmdline systemctl /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems systemctl -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes:
description ioc /tmp/vskimiglrc /tmp/vskimiglrc /tmp/topjjpjuth /tmp/topjjpjuth /tmp/xepsezytei /tmp/xepsezytei
Processes
-
./46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0./46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f01⤵PID:581
-
/bin/chkconfigchkconfig --add 46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f01⤵PID:584
-
/sbin/chkconfigchkconfig --add 46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f01⤵PID:584
-
/usr/bin/chkconfigchkconfig --add 46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f01⤵PID:584
-
/usr/sbin/chkconfigchkconfig --add 46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f01⤵PID:584
-
/usr/local/bin/chkconfigchkconfig --add 46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f01⤵PID:584
-
/usr/local/sbin/chkconfigchkconfig --add 46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f01⤵PID:584
-
/usr/X11R6/bin/chkconfigchkconfig --add 46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f01⤵PID:584
-
/bin/shsh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"1⤵
- Creates/modifies Cron job
PID:587 -
/bin/sedsed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab2⤵
- Creates/modifies Cron job
- Reads runtime system information
PID:588
-
/bin/update-rc.dupdate-rc.d 46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0 defaults1⤵PID:586
-
/sbin/update-rc.dupdate-rc.d 46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0 defaults1⤵PID:586
-
/usr/bin/update-rc.dupdate-rc.d 46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0 defaults1⤵PID:586
-
/usr/sbin/update-rc.dupdate-rc.d 46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0 defaults1⤵
- Modifies rc script
- Write file to user bin folder
PID:586 -
/bin/systemctlsystemctl daemon-reload2⤵
- Reads runtime system information
PID:595
-
/usr/bin/vskimiglrc/usr/bin/vskimiglrc "cd /etc" 5821⤵PID:593
-
/usr/bin/vskimiglrc/usr/bin/vskimiglrc "netstat -an" 5821⤵PID:601
-
/usr/bin/vskimiglrc/usr/bin/vskimiglrc "sleep 1" 5821⤵PID:618
-
/usr/bin/vskimiglrc/usr/bin/vskimiglrc "ps -ef" 5821⤵PID:622
-
/usr/bin/vskimiglrc/usr/bin/vskimiglrc "grep \"A\"" 5821⤵PID:625
-
/usr/bin/topjjpjuth/usr/bin/topjjpjuth sh 5821⤵PID:628
-
/usr/bin/topjjpjuth/usr/bin/topjjpjuth ifconfig 5821⤵PID:631
-
/usr/bin/topjjpjuth/usr/bin/topjjpjuth ls 5821⤵PID:634
-
/usr/bin/topjjpjuth/usr/bin/topjjpjuth "ls -la" 5821⤵PID:637
-
/usr/bin/topjjpjuth/usr/bin/topjjpjuth "cd /etc" 5821⤵PID:640
-
/usr/bin/xepsezytei/usr/bin/xepsezytei "ifconfig eth0" 5821⤵PID:643
-
/usr/bin/xepsezytei/usr/bin/xepsezytei ls 5821⤵PID:646
-
/usr/bin/xepsezytei/usr/bin/xepsezytei pwd 5821⤵PID:649
-
/usr/bin/xepsezytei/usr/bin/xepsezytei "netstat -antop" 5821⤵PID:652
-
/usr/bin/xepsezytei/usr/bin/xepsezytei "netstat -antop" 5821⤵PID:655
-
/usr/bin/sfgbdkvpei/usr/bin/sfgbdkvpei top 5821⤵PID:658