Analysis
-
max time kernel
6291s -
max time network
154s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
submitted
19-02-2022 07:00
Static task
static1
Behavioral task
behavioral1
Sample
ca21a60bf8ffb7414a9e52a2e1574b0f15797e5e32ca196bf093b2cf7c2b0a49
Resource
ubuntu1804-amd64-en-20211208
0 signatures
0 seconds
General
-
Target
ca21a60bf8ffb7414a9e52a2e1574b0f15797e5e32ca196bf093b2cf7c2b0a49
-
Size
651KB
-
MD5
1d1a7c789bd31b95622e8a907e3d675e
-
SHA1
ba1c514964ea1d48705fff9bd5da8d7f4a170e4a
-
SHA256
ca21a60bf8ffb7414a9e52a2e1574b0f15797e5e32ca196bf093b2cf7c2b0a49
-
SHA512
3734bf6eaa703f257ba0fc3e08517239dcc8cf79ad1f0a285232044584e573041242319dda1af856f419a5f2518f4655972ac30847db6b580adf5943d15f9d14
Score
9/10
Malware Config
Signatures
-
Deletes system logs 1 TTPs 3 IoCs
Processes:
rmtouchchattrdescription ioc process /var/log/syslog /var/log/syslog rm /var/log/syslog /var/log/syslog touch /var/log/syslog /var/log/syslog chattr
Processes
-
./ca21a60bf8ffb7414a9e52a2e1574b0f15797e5e32ca196bf093b2cf7c2b0a49./ca21a60bf8ffb7414a9e52a2e1574b0f15797e5e32ca196bf093b2cf7c2b0a491⤵PID:571
-
/bin/shsh -c "rm -rf /var/log/syslog;touch /var/log/syslog;chmod 0000 /var/log/syslog;chattr +isa /var/log/syslog;"2⤵PID:572
-
/bin/rmrm -rf /var/log/syslog3⤵
- Deletes system logs
PID:573 -
/usr/bin/touchtouch /var/log/syslog3⤵
- Deletes system logs
PID:574 -
/bin/chmodchmod 0000 /var/log/syslog3⤵PID:575
-
/usr/bin/chattrchattr +isa /var/log/syslog3⤵
- Deletes system logs
PID:576