Analysis

  • max time kernel
    6291s
  • max time network
    154s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • submitted
    19-02-2022 07:00

General

  • Target

    ca21a60bf8ffb7414a9e52a2e1574b0f15797e5e32ca196bf093b2cf7c2b0a49

  • Size

    651KB

  • MD5

    1d1a7c789bd31b95622e8a907e3d675e

  • SHA1

    ba1c514964ea1d48705fff9bd5da8d7f4a170e4a

  • SHA256

    ca21a60bf8ffb7414a9e52a2e1574b0f15797e5e32ca196bf093b2cf7c2b0a49

  • SHA512

    3734bf6eaa703f257ba0fc3e08517239dcc8cf79ad1f0a285232044584e573041242319dda1af856f419a5f2518f4655972ac30847db6b580adf5943d15f9d14

Score
9/10

Malware Config

Signatures

  • Deletes system logs 1 TTPs 3 IoCs

Processes

  • ./ca21a60bf8ffb7414a9e52a2e1574b0f15797e5e32ca196bf093b2cf7c2b0a49
    ./ca21a60bf8ffb7414a9e52a2e1574b0f15797e5e32ca196bf093b2cf7c2b0a49
    1⤵
      PID:571
      • /bin/sh
        sh -c "rm -rf /var/log/syslog;touch /var/log/syslog;chmod 0000 /var/log/syslog;chattr +isa /var/log/syslog;"
        2⤵
          PID:572
          • /bin/rm
            rm -rf /var/log/syslog
            3⤵
            • Deletes system logs
            PID:573
          • /usr/bin/touch
            touch /var/log/syslog
            3⤵
            • Deletes system logs
            PID:574
          • /bin/chmod
            chmod 0000 /var/log/syslog
            3⤵
              PID:575
            • /usr/bin/chattr
              chattr +isa /var/log/syslog
              3⤵
              • Deletes system logs
              PID:576

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads