Analysis
-
max time kernel
0s -
max time network
104s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
submitted
05-04-2022 12:19
General
-
Target
23sgqdsvuhq
-
Size
549KB
-
MD5
b4ff3961cefcc5e151e319666bae6f5e
-
SHA1
e1e985a90a116edea41d99b3e2a85a697f760d48
-
SHA256
71ef590b32ef90a021be7bafd074b7698ffefab7f935e371568bef5eb2543f19
-
SHA512
e4a6eed3bbedf52e8b636ddfa34bde662dd9f8b7fd7745dc7689605b966bf24b0ed76bf9e418dab5d32668b9b6ecdc09b0e5da8cd011a274d8186cc169f4d52e
Score
10/10
Malware Config
Signatures
-
suricata: ET MALWARE DDoS.XOR Checkin via HTTP
suricata: ET MALWARE DDoS.XOR Checkin via HTTP
-
Writes file to system bin folder 1 TTPs 16 IoCs
-
Modifies rc script 1 TTPs 5 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
./23sgqdsvuhq./23sgqdsvuhq1⤵
-
/bin/yjkcaauokj/bin/yjkcaauokj1⤵
-
/bin/mbdeknfixl/bin/mbdeknfixl -d 5971⤵
-
/bin/ccrmab/bin/ccrmab -d 5971⤵
-
/bin/jkebetcpxtarn/bin/jkebetcpxtarn -d 5971⤵
-
/bin/psrvfs/bin/psrvfs -d 5971⤵
-
/bin/nvhsxbgzeg/bin/nvhsxbgzeg -d 5971⤵
-
/bin/mnvfpkeikvyb/bin/mnvfpkeikvyb -d 5971⤵
-
/bin/qsiwnvlidd/bin/qsiwnvlidd -d 5971⤵
-
/bin/glhkruaehvlxhq/bin/glhkruaehvlxhq -d 5971⤵
-
/bin/ulfvywqh/bin/ulfvywqh -d 5971⤵
-
/bin/dcdlhjtnud/bin/dcdlhjtnud -d 5971⤵
-
/bin/oxasev/bin/oxasev -d 5971⤵
-
/bin/ddtnzh/bin/ddtnzh -d 5971⤵
-
/bin/ufqkminrob/bin/ufqkminrob -d 5971⤵
-
/bin/zwovzp/bin/zwovzp -d 5971⤵
-
/bin/ypddnh/bin/ypddnh -d 5971⤵
-
/bin/scvrlo/bin/scvrlo -d 5971⤵
-
/bin/rgwfrlyhmzg/bin/rgwfrlyhmzg -d 5971⤵