Analysis
-
max time kernel
0s -
max time network
27s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
submitted
25-04-2022 21:32
Static task
static1
Behavioral task
behavioral1
Sample
23schaqfoys
Resource
ubuntu1804-amd64-en-20211208
linux_amd64
0 signatures
0 seconds
General
-
Target
23schaqfoys
-
Size
549KB
-
MD5
b4ff3961cefcc5e151e319666bae6f5e
-
SHA1
e1e985a90a116edea41d99b3e2a85a697f760d48
-
SHA256
71ef590b32ef90a021be7bafd074b7698ffefab7f935e371568bef5eb2543f19
-
SHA512
e4a6eed3bbedf52e8b636ddfa34bde662dd9f8b7fd7745dc7689605b966bf24b0ed76bf9e418dab5d32668b9b6ecdc09b0e5da8cd011a274d8186cc169f4d52e
Score
9/10
Malware Config
Signatures
-
Writes file to system bin folder 1 TTPs 17 IoCs
Processes:
description ioc /bin/dlgehxqlze /bin/dlgehxqlze /bin/gmyfsmaytn /bin/gmyfsmaytn /bin/svjlrraa /bin/svjlrraa /bin/zmathmg /bin/zmathmg /bin/jkcvmxfye /bin/jkcvmxfye /bin/xobmhbgl /bin/xobmhbgl /bin/cyqqxvkjxkem /bin/cyqqxvkjxkem /bin/suzqbhy /bin/suzqbhy /bin/hbyupkezoaux /bin/hbyupkezoaux /bin/srpujs /bin/srpujs /bin/vdgnxxhgplqbp /bin/vdgnxxhgplqbp /bin/sxdiivjz /bin/sxdiivjz /bin/xjnhtiqvtq /bin/xjnhtiqvtq /bin/xerakckodaecx /bin/xerakckodaecx /bin/zqjliuggzladkk /bin/zqjliuggzladkk /bin/nmlikcwsis /bin/nmlikcwsis /bin/onsmrysegw /bin/onsmrysegw -
Modifies rc script 1 TTPs 5 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
Processes:
description ioc /etc/rc1.d/S90zpuyemrhsq /etc/rc1.d/S90zpuyemrhsq /etc/rc2.d/S90zpuyemrhsq /etc/rc2.d/S90zpuyemrhsq /etc/rc3.d/S90zpuyemrhsq /etc/rc3.d/S90zpuyemrhsq /etc/rc4.d/S90zpuyemrhsq /etc/rc4.d/S90zpuyemrhsq /etc/rc5.d/S90zpuyemrhsq /etc/rc5.d/S90zpuyemrhsq -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
description ioc /tmp/23schaqfoys /tmp/23schaqfoys
Processes
-
./23schaqfoys./23schaqfoys1⤵PID:580
-
/bin/qshrmeyupz/bin/qshrmeyupz1⤵PID:584
-
/bin/zqjliuggzladkk/bin/zqjliuggzladkk -d 5851⤵PID:589
-
/bin/svjlrraa/bin/svjlrraa -d 5851⤵PID:592
-
/bin/nmlikcwsis/bin/nmlikcwsis -d 5851⤵PID:599
-
/bin/suzqbhy/bin/suzqbhy -d 5851⤵PID:602
-
/bin/zmathmg/bin/zmathmg -d 5851⤵PID:605
-
/bin/hbyupkezoaux/bin/hbyupkezoaux -d 5851⤵PID:609
-
/bin/srpujs/bin/srpujs -d 5851⤵PID:612
-
/bin/jkcvmxfye/bin/jkcvmxfye -d 5851⤵PID:615
-
/bin/dlgehxqlze/bin/dlgehxqlze -d 5851⤵PID:618
-
/bin/vdgnxxhgplqbp/bin/vdgnxxhgplqbp -d 5851⤵PID:621
-
/bin/onsmrysegw/bin/onsmrysegw -d 5851⤵PID:624
-
/bin/gmyfsmaytn/bin/gmyfsmaytn -d 5851⤵PID:627
-
/bin/sxdiivjz/bin/sxdiivjz -d 5851⤵PID:630
-
/bin/xobmhbgl/bin/xobmhbgl -d 5851⤵PID:633
-
/bin/cyqqxvkjxkem/bin/cyqqxvkjxkem -d 5851⤵PID:636
-
/bin/xjnhtiqvtq/bin/xjnhtiqvtq -d 5851⤵PID:639
-
/bin/xerakckodaecx/bin/xerakckodaecx -d 5851⤵PID:642