eeca533a472175b80747c836cb1dde26633102f72aa6245265f330c6a611894d | Triage

Analysis

max time kernel
6209s
max time network
153s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
submitted
18/02/2022, 06:23

Sharing

Report Analysis Logs

General

Target

eeca533a472175b80747c836cb1dde26633102f72aa6245265f330c6a611894d
Size

1.2MB
MD5

8015d5a208ee25ee41d5bf17ab195ce5
SHA1

98b9759845f154baafd0ceb649c51666a8e6973e
SHA256

eeca533a472175b80747c836cb1dde26633102f72aa6245265f330c6a611894d
SHA512

698be70b3cb9afef2243461ce65cc5d3e4ab6ca8642a602b90d0a9ce518ea39508389778bb1e48050ebe58ce5efbbe185cb47aab8f57ca853ea7135d21b838b0

Score

7^/10

Malware Config

Signatures

Write file to user bin folder 1 TTPs 3 IoCs

Hijack Execution Flow

description	ioc	Process
/usr/bin/bsd-port/getty	/usr/bin/bsd-port/getty	cp
/usr/bin/.sshd	/usr/bin/.sshd	cp
/usr/bin/bsd-port/udevd.lock	/usr/bin/bsd-port/udevd.lock	Process not Found

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	cp
/proc/cmdline	/proc/cmdline	insmod
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	mkdir

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/eeca533a472175b80747c836cb1dde26633102f72aa6245265f330c6a611894d	/tmp/eeca533a472175b80747c836cb1dde26633102f72aa6245265f330c6a611894d	cp
/tmp/notify.file	/tmp/notify.file	Process not Found
/tmp/update_temporary	/tmp/update_temporary	Process not Found
/tmp/bill.lock	/tmp/bill.lock	Process not Found
/tmp/eeca533a472175b80747c836cb1dde26633102f72aa6245265f330c6a611894d	/tmp/eeca533a472175b80747c836cb1dde26633102f72aa6245265f330c6a611894d	cp

./eeca533a472175b80747c836cb1dde26633102f72aa6245265f330c6a611894d
./eeca533a472175b80747c836cb1dde26633102f72aa6245265f330c6a611894d
1⤵
PID:577

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
1⤵
PID:583
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:584

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
1⤵
PID:585
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:586

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
1⤵
PID:587
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:588

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
1⤵
PID:589
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:590

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
1⤵
PID:591
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:592

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:593
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:594

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:595
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:596

/bin/sh
sh -c "cp -f /tmp/eeca533a472175b80747c836cb1dde26633102f72aa6245265f330c6a611894d /usr/bin/bsd-port/getty"
1⤵
PID:597
- /bin/cp
  cp -f /tmp/eeca533a472175b80747c836cb1dde26633102f72aa6245265f330c6a611894d /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  - Writes file to tmp directory
  PID:598

/bin/sh
sh -c /usr/bin/bsd-port/getty
1⤵
PID:600
- /usr/bin/bsd-port/getty
  /usr/bin/bsd-port/getty
  2⤵
  PID:601

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:602
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:603

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:604
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:605

/bin/sh
sh -c "cp -f /tmp/eeca533a472175b80747c836cb1dde26633102f72aa6245265f330c6a611894d /usr/bin/.sshd"
1⤵
PID:606
- /bin/cp
  cp -f /tmp/eeca533a472175b80747c836cb1dde26633102f72aa6245265f330c6a611894d /usr/bin/.sshd
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  - Writes file to tmp directory
  PID:607

/bin/sh
sh -c /usr/bin/.sshd
1⤵
PID:609
- /usr/bin/.sshd
  /usr/bin/.sshd
  2⤵
  PID:610

/bin/sh
sh -c "insmod /tmp/xpacket.ko"
1⤵
PID:613
- /sbin/insmod
  insmod /tmp/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:614

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads