177de2e81e59660dbbcb6c5506d22ab5ab5a5e2fe7b9d44bb83d8c2431863f23 | Triage™

Analysis

max time kernel
0s
max time network
103s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
submitted
09/03/2022, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pty4
Size 43KB
Sample220309-v8xtfseafl
SHA256 177de2e81e59660dbbcb6c5506d22ab5ab5a5e2fe7b9d44bb83d8c2431863f23
MD5 9a3ec09ab3ac132d5089e293e22078ff
SHA1 a9791ba664dff0e29020532152b5573649af1c71
SHA512 c5dc5838bf3d218f5f2557cbc16f67aeb174751f6df91b0848cd4d8164a82c2a423eec74f97a063b9aca25f3476677191ee34c437c0db1680c806d2071306381
MD5 SHA1 SHA512

Score

10^/10

suricata

Malware Config

Signatures

suricata: ET MALWARE ELF/Muhstik Botnet CnC Activity
suricata: ET MALWARE ELF/Muhstik Botnet CnC Activity
suricata

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/pty4	/tmp/pty4	cp
/tmp/pty4	/tmp/pty4	cp
/tmp/pty4	/tmp/pty4	cp
/tmp/pty4	/tmp/pty4	cp

./pty4
./pty4
1⤵
PID:577

/bin/sh
sh -c "pidof -x strace > /dev/null"
1⤵
PID:578
- /bin/pidof
  pidof -x strace
  2⤵
  PID:579

/bin/sh
sh -c "pidof -x tcpdump > /dev/null"
1⤵
PID:580
- /bin/pidof
  pidof -x tcpdump
  2⤵
  PID:581

/bin/sh
sh -c "cat /etc/inittab | grep -v \"/tmp/pty4\" > /etc/inittab2"
1⤵
PID:584
- /bin/cat
  cat /etc/inittab
  2⤵
  PID:586
- /bin/grep
  grep -v /tmp/pty4
  2⤵
  PID:588

/bin/sh
sh -c "crontab -l | grep /tmp/pty4 | grep -v \"no cron\" || (crontab -l ; echo \"* * * * * /tmp/pty4 > /dev/null 2>&1 &\") | crontab -"
1⤵
PID:585
- /bin/grep
  grep /tmp/pty4
  2⤵
  PID:591
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:589
- /bin/grep
  grep -v "no cron"
  2⤵
  PID:592
- /usr/bin/crontab
  crontab -
  2⤵
  PID:596

/bin/sh
sh -c "crontab -r"
1⤵
PID:587
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:590

/bin/sh
sh -c "echo \"0:2345:respawn:/tmp/pty4\" >> /etc/inittab2"
1⤵
PID:593

/bin/sh
sh -c "cat /etc/inittab2 > /etc/inittab"
1⤵
PID:594
- /bin/cat
  cat /etc/inittab2
  2⤵
  PID:598

/usr/bin/crontab
crontab -l
1⤵
PID:597

/bin/sh
sh -c "rm -rf /etc/inittab2"
1⤵
PID:599
- /bin/rm
  rm -rf /etc/inittab2
  2⤵
  PID:600

/bin/sh
sh -c "touch -acmr /bin/ls /etc/inittab"
1⤵
PID:601
- /usr/bin/touch
  touch -acmr /bin/ls /etc/inittab
  2⤵
  PID:602

/bin/sh
sh -c "/bin/uname -n"
1⤵
PID:605
- /bin/uname
  /bin/uname -n
  2⤵
  PID:608

/bin/sh
sh -c "cp -f /tmp/pty4 /dev/shm/pty4"
1⤵
PID:606
- /bin/cp
  cp -f /tmp/pty4 /dev/shm/pty4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:611

/bin/sh
sh -c "cat /etc/inittab | grep -v \"/dev/shm/pty4\" > /etc/inittab2"
1⤵
PID:614
- /bin/grep
  grep -v /dev/shm/pty4
  2⤵
  PID:617
- /bin/cat
  cat /etc/inittab
  2⤵
  PID:615

/bin/sh
sh -c "crontab -l | grep /dev/shm/pty4 | grep -v \"no cron\" || (crontab -l ; echo \"* * * * * /dev/shm/pty4 > /dev/null 2>&1 &\") | crontab -"
1⤵
PID:616
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:618
- /bin/grep
  grep /dev/shm/pty4
  2⤵
  PID:619
- /bin/grep
  grep -v "no cron"
  2⤵
  PID:621
- /usr/bin/crontab
  crontab -
  2⤵
  PID:624

/bin/sh
sh -c "echo \"0:2345:respawn:/dev/shm/pty4\" >> /etc/inittab2"
1⤵
PID:620

/bin/sh
sh -c "cat /etc/inittab2 > /etc/inittab"
1⤵
PID:622
- /bin/cat
  cat /etc/inittab2
  2⤵
  PID:625

/usr/bin/crontab
crontab -l
1⤵
PID:626

/bin/sh
sh -c "rm -rf /etc/inittab2"
1⤵
PID:627
- /bin/rm
  rm -rf /etc/inittab2
  2⤵
  PID:628

/bin/sh
sh -c "touch -acmr /bin/ls /etc/inittab"
1⤵
PID:629
- /usr/bin/touch
  touch -acmr /bin/ls /etc/inittab
  2⤵
  PID:630

/bin/sh
sh -c "cp -f /tmp/pty4 /var/tmp/pty4"
1⤵
PID:631
- /bin/cp
  cp -f /tmp/pty4 /var/tmp/pty4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:632

/bin/sh
sh -c "cat /etc/inittab | grep -v \"/var/tmp/pty4\" > /etc/inittab2"
1⤵
PID:634
- /bin/cat
  cat /etc/inittab
  2⤵
  PID:636
- /bin/grep
  grep -v /var/tmp/pty4
  2⤵
  PID:638

/bin/sh
sh -c "crontab -l | grep /var/tmp/pty4 | grep -v \"no cron\" || (crontab -l ; echo \"* * * * * /var/tmp/pty4 > /dev/null 2>&1 &\") | crontab -"
1⤵
PID:635
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:637
- /bin/grep
  grep /var/tmp/pty4
  2⤵
  PID:639
- /bin/grep
  grep -v "no cron"
  2⤵
  PID:640
- /usr/bin/crontab
  crontab -
  2⤵
  PID:643

/bin/sh
sh -c "echo \"0:2345:respawn:/var/tmp/pty4\" >> /etc/inittab2"
1⤵
PID:641

/bin/sh
sh -c "cat /etc/inittab2 > /etc/inittab"
1⤵
PID:644
- /bin/cat
  cat /etc/inittab2
  2⤵
  PID:646

/usr/bin/crontab
crontab -l
1⤵
PID:645

/bin/sh
sh -c "rm -rf /etc/inittab2"
1⤵
PID:647
- /bin/rm
  rm -rf /etc/inittab2
  2⤵
  PID:648

/bin/sh
sh -c "touch -acmr /bin/ls /etc/inittab"
1⤵
PID:649
- /usr/bin/touch
  touch -acmr /bin/ls /etc/inittab
  2⤵
  PID:650

/bin/sh
sh -c "cp -f /tmp/pty4 /var/lock/pty4"
1⤵
PID:651
- /bin/cp
  cp -f /tmp/pty4 /var/lock/pty4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:652

/bin/sh
sh -c "cat /etc/inittab | grep -v \"/var/lock/pty4\" > /etc/inittab2"
1⤵
PID:654
- /bin/cat
  cat /etc/inittab
  2⤵
  PID:655
- /bin/grep
  grep -v /var/lock/pty4
  2⤵
  PID:657

/bin/sh
sh -c "crontab -l | grep /var/lock/pty4 | grep -v \"no cron\" || (crontab -l ; echo \"* * * * * /var/lock/pty4 > /dev/null 2>&1 &\") | crontab -"
1⤵
PID:656
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:658
- /bin/grep
  grep /var/lock/pty4
  2⤵
  PID:659
- /bin/grep
  grep -v "no cron"
  2⤵
  PID:660
- /usr/bin/crontab
  crontab -
  2⤵
  PID:664

/bin/sh
sh -c "echo \"0:2345:respawn:/var/lock/pty4\" >> /etc/inittab2"
1⤵
PID:661

/bin/sh
sh -c "cat /etc/inittab2 > /etc/inittab"
1⤵
PID:662
- /bin/cat
  cat /etc/inittab2
  2⤵
  PID:665

/usr/bin/crontab
crontab -l
1⤵
PID:666

/bin/sh
sh -c "rm -rf /etc/inittab2"
1⤵
PID:667
- /bin/rm
  rm -rf /etc/inittab2
  2⤵
  PID:668

/bin/sh
sh -c "touch -acmr /bin/ls /etc/inittab"
1⤵
PID:669
- /usr/bin/touch
  touch -acmr /bin/ls /etc/inittab
  2⤵
  PID:670

/bin/sh
sh -c "cp -f /tmp/pty4 /var/run/pty4"
1⤵
PID:671
- /bin/cp
  cp -f /tmp/pty4 /var/run/pty4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:672

/bin/sh
sh -c "cat /etc/inittab | grep -v \"/var/run/pty4\" > /etc/inittab2"
1⤵
PID:674
- /bin/grep
  grep -v /var/run/pty4
  2⤵
  PID:677
- /bin/cat
  cat /etc/inittab
  2⤵
  PID:675

/bin/sh
sh -c "crontab -l | grep /var/run/pty4 | grep -v \"no cron\" || (crontab -l ; echo \"* * * * * /var/run/pty4 > /dev/null 2>&1 &\") | crontab -"
1⤵
PID:676
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:678
- /bin/grep
  grep /var/run/pty4
  2⤵
  PID:679
- /bin/grep
  grep -v "no cron"
  2⤵
  PID:681
- /usr/bin/crontab
  crontab -
  2⤵
  PID:685

/bin/sh
sh -c "echo \"0:2345:respawn:/var/run/pty4\" >> /etc/inittab2"
1⤵
PID:680

/bin/sh
sh -c "cat /etc/inittab2 > /etc/inittab"
1⤵
PID:682
- /bin/cat
  cat /etc/inittab2
  2⤵
  PID:684

/usr/bin/crontab
crontab -l
1⤵
PID:686

/bin/sh
sh -c "rm -rf /etc/inittab2"
1⤵
PID:687
- /bin/rm
  rm -rf /etc/inittab2
  2⤵
  PID:688

/bin/sh
sh -c "touch -acmr /bin/ls /etc/inittab"
1⤵
PID:689
- /usr/bin/touch
  touch -acmr /bin/ls /etc/inittab
  2⤵
  PID:690

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads