Overview

overview

10

Static

static

10

ca22002822...fd2eed

linux_amd64

7

Analysis

  • max time kernel
    6210s
  • max time network
    134s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • submitted
    18/02/2022, 06:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ca22002822b27562971b1b12bfd61f2f670554ebdb0907270fda4a65f7fd2eed

  • Size

    1.2MB

  • MD5

    80d0cac0cd6be8010819fdcd7ac4af46

  • SHA1

    adb2208a2016c6686c52d440f518098b4cbe3846

  • SHA256

    ca22002822b27562971b1b12bfd61f2f670554ebdb0907270fda4a65f7fd2eed

  • SHA512

    d0f1da32dd1f70ce3f918230c39c3d7a6210998f0a3ea0262805611156e3d37e8af237d14e3bf19eba0d7ea5b154621880fe3eadaea87bfc6e6337c6a5294a48

Score
7/10

Malware Config

Signatures

  • Write file to user bin folder 1 TTPs 3 IoCs
  • Reads runtime system information 7 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 5 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • ./ca22002822b27562971b1b12bfd61f2f670554ebdb0907270fda4a65f7fd2eed
    ./ca22002822b27562971b1b12bfd61f2f670554ebdb0907270fda4a65f7fd2eed
    1⤵
      PID:571
    • /bin/sh
      sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
      1⤵
        PID:577
        • /bin/ln
          ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
          2⤵
            PID:578
        • /bin/sh
          sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
          1⤵
            PID:579
            • /bin/ln
              ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
              2⤵
                PID:580
            • /bin/sh
              sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
              1⤵
                PID:581
                • /bin/ln
                  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
                  2⤵
                    PID:582
                • /bin/sh
                  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
                  1⤵
                    PID:583
                    • /bin/ln
                      ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
                      2⤵
                        PID:584
                    • /bin/sh
                      sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
                      1⤵
                        PID:585
                        • /bin/ln
                          ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
                          2⤵
                            PID:586
                        • /bin/sh
                          sh -c "mkdir -p /usr/bin/bsd-port"
                          1⤵
                            PID:587
                            • /bin/mkdir
                              mkdir -p /usr/bin/bsd-port
                              2⤵
                              • Reads runtime system information
                              PID:588
                          • /bin/sh
                            sh -c "mkdir -p /usr/bin/bsd-port"
                            1⤵
                              PID:589
                              • /bin/mkdir
                                mkdir -p /usr/bin/bsd-port
                                2⤵
                                • Reads runtime system information
                                PID:590
                            • /bin/sh
                              sh -c "cp -f /tmp/ca22002822b27562971b1b12bfd61f2f670554ebdb0907270fda4a65f7fd2eed /usr/bin/bsd-port/getty"
                              1⤵
                                PID:591
                                • /bin/cp
                                  cp -f /tmp/ca22002822b27562971b1b12bfd61f2f670554ebdb0907270fda4a65f7fd2eed /usr/bin/bsd-port/getty
                                  2⤵
                                  • Write file to user bin folder
                                  • Reads runtime system information
                                  • Writes file to tmp directory
                                  PID:592
                              • /bin/sh
                                sh -c /usr/bin/bsd-port/getty
                                1⤵
                                  PID:594
                                  • /usr/bin/bsd-port/getty
                                    /usr/bin/bsd-port/getty
                                    2⤵
                                      PID:595
                                  • /bin/sh
                                    sh -c "mkdir -p /usr/bin"
                                    1⤵
                                      PID:596
                                      • /bin/mkdir
                                        mkdir -p /usr/bin
                                        2⤵
                                        • Reads runtime system information
                                        PID:597
                                    • /bin/sh
                                      sh -c "mkdir -p /usr/bin"
                                      1⤵
                                        PID:598
                                        • /bin/mkdir
                                          mkdir -p /usr/bin
                                          2⤵
                                          • Reads runtime system information
                                          PID:599
                                      • /bin/sh
                                        sh -c "cp -f /tmp/ca22002822b27562971b1b12bfd61f2f670554ebdb0907270fda4a65f7fd2eed /usr/bin/.sshd"
                                        1⤵
                                          PID:600
                                          • /bin/cp
                                            cp -f /tmp/ca22002822b27562971b1b12bfd61f2f670554ebdb0907270fda4a65f7fd2eed /usr/bin/.sshd
                                            2⤵
                                            • Write file to user bin folder
                                            • Reads runtime system information
                                            • Writes file to tmp directory
                                            PID:601
                                        • /bin/sh
                                          sh -c /usr/bin/.sshd
                                          1⤵
                                            PID:603
                                            • /usr/bin/.sshd
                                              /usr/bin/.sshd
                                              2⤵
                                                PID:604
                                            • /bin/sh
                                              sh -c "insmod /tmp/xpacket.ko"
                                              1⤵
                                                PID:607
                                                • /sbin/insmod
                                                  insmod /tmp/xpacket.ko
                                                  2⤵
                                                  • Reads runtime system information
                                                  PID:608

                                              Network

                                              MITRE ATT&CK Enterprise v6

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads