Overview

overview

10

Static

static

10

59e9a55a03...2d43c1

linux_amd64

7

Analysis

  • max time kernel
    12472s
  • max time network
    151s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • submitted
    02-05-2022 01:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1

  • Size

    699KB

  • MD5

    a3a70a53a5d4e4a4ef24c0f7e0757490

  • SHA1

    94efef21f765a4c6af2219760fb374b786006308

  • SHA256

    59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1

  • SHA512

    85634593967a3932a3df5e2525b844194d6cbae15a662dbfc626e1f51c542f9f1e1058659ff13578f96a3057c4efb15471af968226aedcb0b289953f53310682

Score
7/10
persistence

Malware Config

Signatures

  • Modifies init.d 1 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 1 TTPs 11 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Reads CPU attributes 1 TTPs 10 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • ./59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1
    ./59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1
    1⤵
      PID:577
    • /bin/sh
      sh -c "nohup sh /delallmykkk>/dev/null"
      1⤵
        PID:582
        • /usr/bin/nohup
          nohup sh /delallmykkk
          2⤵
            PID:583
          • /usr/local/sbin/sh
            sh /delallmykkk
            2⤵
              PID:583
            • /usr/local/bin/sh
              sh /delallmykkk
              2⤵
                PID:583
              • /usr/sbin/sh
                sh /delallmykkk
                2⤵
                  PID:583
                • /usr/bin/sh
                  sh /delallmykkk
                  2⤵
                    PID:583
                  • /sbin/sh
                    sh /delallmykkk
                    2⤵
                      PID:583
                    • /bin/sh
                      sh /delallmykkk
                      2⤵
                        PID:583
                        • /bin/grep
                          grep .IptabLes
                          3⤵
                            PID:585
                          • /bin/ps
                            ps -axu
                            3⤵
                            • Reads CPU attributes
                            • Reads runtime system information
                            PID:584
                          • /usr/bin/awk
                            awk "{print \$2}"
                            3⤵
                              PID:586
                            • /usr/bin/xargs
                              xargs kill -9
                              3⤵
                                PID:587
                                • /usr/local/sbin/kill
                                  kill -9 585
                                  4⤵
                                    PID:588
                                  • /usr/local/bin/kill
                                    kill -9 585
                                    4⤵
                                      PID:588
                                    • /usr/sbin/kill
                                      kill -9 585
                                      4⤵
                                        PID:588
                                      • /usr/bin/kill
                                        kill -9 585
                                        4⤵
                                          PID:588
                                        • /sbin/kill
                                          kill -9 585
                                          4⤵
                                            PID:588
                                          • /bin/kill
                                            kill -9 585
                                            4⤵
                                            • Reads CPU attributes
                                            PID:588
                                        • /bin/ps
                                          ps -axu
                                          3⤵
                                          • Reads CPU attributes
                                          • Reads runtime system information
                                          PID:589
                                        • /bin/grep
                                          grep .IptabLes
                                          3⤵
                                            PID:590
                                          • /usr/bin/xargs
                                            xargs kill -9
                                            3⤵
                                              PID:592
                                              • /usr/local/sbin/kill
                                                kill -9 590
                                                4⤵
                                                  PID:593
                                                • /usr/local/bin/kill
                                                  kill -9 590
                                                  4⤵
                                                    PID:593
                                                  • /usr/sbin/kill
                                                    kill -9 590
                                                    4⤵
                                                      PID:593
                                                    • /usr/bin/kill
                                                      kill -9 590
                                                      4⤵
                                                        PID:593
                                                      • /sbin/kill
                                                        kill -9 590
                                                        4⤵
                                                          PID:593
                                                        • /bin/kill
                                                          kill -9 590
                                                          4⤵
                                                          • Reads CPU attributes
                                                          PID:593
                                                      • /usr/bin/awk
                                                        awk "{print \$2}"
                                                        3⤵
                                                          PID:591
                                                        • /bin/ps
                                                          ps -C .IptabLes
                                                          3⤵
                                                          • Reads CPU attributes
                                                          • Reads runtime system information
                                                          PID:594
                                                        • /usr/bin/xargs
                                                          xargs kill -9
                                                          3⤵
                                                            PID:595
                                                            • /usr/local/sbin/kill
                                                              kill -9 PID TTY TIME CMD
                                                              4⤵
                                                                PID:596
                                                              • /usr/local/bin/kill
                                                                kill -9 PID TTY TIME CMD
                                                                4⤵
                                                                  PID:596
                                                                • /usr/sbin/kill
                                                                  kill -9 PID TTY TIME CMD
                                                                  4⤵
                                                                    PID:596
                                                                  • /usr/bin/kill
                                                                    kill -9 PID TTY TIME CMD
                                                                    4⤵
                                                                      PID:596
                                                                    • /sbin/kill
                                                                      kill -9 PID TTY TIME CMD
                                                                      4⤵
                                                                        PID:596
                                                                      • /bin/kill
                                                                        kill -9 PID TTY TIME CMD
                                                                        4⤵
                                                                        • Reads CPU attributes
                                                                        PID:596
                                                                    • /bin/ps
                                                                      ps -C .IptabLes
                                                                      3⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:597
                                                                    • /usr/bin/xargs
                                                                      xargs kill -9
                                                                      3⤵
                                                                        PID:598
                                                                        • /usr/local/sbin/kill
                                                                          kill -9 PID TTY TIME CMD
                                                                          4⤵
                                                                            PID:599
                                                                          • /usr/local/bin/kill
                                                                            kill -9 PID TTY TIME CMD
                                                                            4⤵
                                                                              PID:599
                                                                            • /usr/sbin/kill
                                                                              kill -9 PID TTY TIME CMD
                                                                              4⤵
                                                                                PID:599
                                                                              • /usr/bin/kill
                                                                                kill -9 PID TTY TIME CMD
                                                                                4⤵
                                                                                  PID:599
                                                                                • /sbin/kill
                                                                                  kill -9 PID TTY TIME CMD
                                                                                  4⤵
                                                                                    PID:599
                                                                                  • /bin/kill
                                                                                    kill -9 PID TTY TIME CMD
                                                                                    4⤵
                                                                                    • Reads CPU attributes
                                                                                    PID:599
                                                                                • /bin/ps
                                                                                  ps find / -name "*ptabLes"
                                                                                  3⤵
                                                                                  • Reads CPU attributes
                                                                                  PID:604
                                                                                • /usr/bin/xargs
                                                                                  xargs rm -f
                                                                                  3⤵
                                                                                    PID:605
                                                                                    • /usr/local/sbin/rm
                                                                                      rm -f
                                                                                      4⤵
                                                                                        PID:606
                                                                                      • /usr/local/bin/rm
                                                                                        rm -f
                                                                                        4⤵
                                                                                          PID:606
                                                                                        • /usr/sbin/rm
                                                                                          rm -f
                                                                                          4⤵
                                                                                            PID:606
                                                                                          • /usr/bin/rm
                                                                                            rm -f
                                                                                            4⤵
                                                                                              PID:606
                                                                                            • /sbin/rm
                                                                                              rm -f
                                                                                              4⤵
                                                                                                PID:606
                                                                                              • /bin/rm
                                                                                                rm -f
                                                                                                4⤵
                                                                                                  PID:606
                                                                                              • /bin/ps
                                                                                                ps find / -name .IptabLes
                                                                                                3⤵
                                                                                                • Reads CPU attributes
                                                                                                PID:607
                                                                                              • /usr/bin/xargs
                                                                                                xargs rm -f
                                                                                                3⤵
                                                                                                  PID:608
                                                                                                  • /usr/local/sbin/rm
                                                                                                    rm -f
                                                                                                    4⤵
                                                                                                      PID:609
                                                                                                    • /usr/local/bin/rm
                                                                                                      rm -f
                                                                                                      4⤵
                                                                                                        PID:609
                                                                                                      • /usr/sbin/rm
                                                                                                        rm -f
                                                                                                        4⤵
                                                                                                          PID:609
                                                                                                        • /usr/bin/rm
                                                                                                          rm -f
                                                                                                          4⤵
                                                                                                            PID:609
                                                                                                          • /sbin/rm
                                                                                                            rm -f
                                                                                                            4⤵
                                                                                                              PID:609
                                                                                                            • /bin/rm
                                                                                                              rm -f
                                                                                                              4⤵
                                                                                                                PID:609
                                                                                                            • /bin/rm
                                                                                                              rm -f /boot/.stabip
                                                                                                              3⤵
                                                                                                                PID:610
                                                                                                              • /bin/rm
                                                                                                                rm -f /boot/.IptabLes
                                                                                                                3⤵
                                                                                                                  PID:611
                                                                                                                • /bin/rm
                                                                                                                  rm -f /etc/rc.d/init.d/IptabLes
                                                                                                                  3⤵
                                                                                                                    PID:612
                                                                                                                  • /bin/rm
                                                                                                                    rm -f /boot/IptabLes
                                                                                                                    3⤵
                                                                                                                      PID:613
                                                                                                                    • /bin/rm
                                                                                                                      rm -f /tmp/IptabLes
                                                                                                                      3⤵
                                                                                                                      • Writes file to tmp directory
                                                                                                                      PID:614
                                                                                                                    • /bin/rm
                                                                                                                      rm -f /usr/.IptabLes
                                                                                                                      3⤵
                                                                                                                        PID:615
                                                                                                                      • /bin/rm
                                                                                                                        rm -f "/etc/rc.d/rc4.d/*IptabLes"
                                                                                                                        3⤵
                                                                                                                          PID:616
                                                                                                                        • /bin/rm
                                                                                                                          rm -f "/etc/rc.d/rc1.d/*IptabLes"
                                                                                                                          3⤵
                                                                                                                            PID:617
                                                                                                                          • /bin/rm
                                                                                                                            rm -f "/etc/rc.d/rc2.d/*IptabLes"
                                                                                                                            3⤵
                                                                                                                              PID:618
                                                                                                                            • /bin/rm
                                                                                                                              rm -f "/etc/rc.d/rc3.d/*IptabLes"
                                                                                                                              3⤵
                                                                                                                                PID:619
                                                                                                                              • /bin/rm
                                                                                                                                rm -f "/etc/rc.d/rc0.d/*IptabLes"
                                                                                                                                3⤵
                                                                                                                                  PID:620
                                                                                                                                • /bin/rm
                                                                                                                                  rm -f "/etc/rc.d/rc5.d/*IptabLes"
                                                                                                                                  3⤵
                                                                                                                                    PID:621
                                                                                                                                  • /bin/rm
                                                                                                                                    rm -f "/etc/rc.d/rc6.d/*IptabLes"
                                                                                                                                    3⤵
                                                                                                                                      PID:622
                                                                                                                                    • /bin/rm
                                                                                                                                      rm -f /etc/init.d/IptabLes
                                                                                                                                      3⤵
                                                                                                                                      • Modifies init.d
                                                                                                                                      PID:623
                                                                                                                                    • /bin/rm
                                                                                                                                      rm -f "/etc/rc4.d/*IptabLes"
                                                                                                                                      3⤵
                                                                                                                                      • Modifies rc script
                                                                                                                                      PID:624
                                                                                                                                    • /bin/rm
                                                                                                                                      rm -f "/etc/rc1.d/*IptabLes"
                                                                                                                                      3⤵
                                                                                                                                      • Modifies rc script
                                                                                                                                      PID:625
                                                                                                                                    • /bin/rm
                                                                                                                                      rm -f "/etc/rc2.d/*IptabLes"
                                                                                                                                      3⤵
                                                                                                                                      • Modifies rc script
                                                                                                                                      PID:626
                                                                                                                                    • /bin/rm
                                                                                                                                      rm -f "/etc/rc3.d/*IptabLes"
                                                                                                                                      3⤵
                                                                                                                                      • Modifies rc script
                                                                                                                                      PID:627
                                                                                                                                    • /bin/rm
                                                                                                                                      rm -f "/etc/rc0.d/*IptabLes"
                                                                                                                                      3⤵
                                                                                                                                      • Modifies rc script
                                                                                                                                      PID:628
                                                                                                                                    • /bin/rm
                                                                                                                                      rm -f "/etc/rc5.d/*IptabLes"
                                                                                                                                      3⤵
                                                                                                                                      • Modifies rc script
                                                                                                                                      PID:629
                                                                                                                                    • /bin/rm
                                                                                                                                      rm -f "/etc/rc6.d/*IptabLes"
                                                                                                                                      3⤵
                                                                                                                                      • Modifies rc script
                                                                                                                                      PID:630
                                                                                                                                    • /bin/rm
                                                                                                                                      rm -rf /delallmykkk
                                                                                                                                      3⤵
                                                                                                                                        PID:631
                                                                                                                                  • /bin/sh
                                                                                                                                    sh -c "nohup cp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /boot/.IptabLes>/dev/null"
                                                                                                                                    1⤵
                                                                                                                                      PID:632
                                                                                                                                      • /usr/bin/nohup
                                                                                                                                        nohup cp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /boot/.IptabLes
                                                                                                                                        2⤵
                                                                                                                                          PID:633
                                                                                                                                        • /usr/local/sbin/cp
                                                                                                                                          cp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /boot/.IptabLes
                                                                                                                                          2⤵
                                                                                                                                            PID:633
                                                                                                                                          • /usr/local/bin/cp
                                                                                                                                            cp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /boot/.IptabLes
                                                                                                                                            2⤵
                                                                                                                                              PID:633
                                                                                                                                            • /usr/sbin/cp
                                                                                                                                              cp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /boot/.IptabLes
                                                                                                                                              2⤵
                                                                                                                                                PID:633
                                                                                                                                              • /usr/bin/cp
                                                                                                                                                cp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /boot/.IptabLes
                                                                                                                                                2⤵
                                                                                                                                                  PID:633
                                                                                                                                                • /sbin/cp
                                                                                                                                                  cp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /boot/.IptabLes
                                                                                                                                                  2⤵
                                                                                                                                                    PID:633
                                                                                                                                                  • /bin/cp
                                                                                                                                                    cp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /boot/.IptabLes
                                                                                                                                                    2⤵
                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                    PID:633
                                                                                                                                                • /bin/sh
                                                                                                                                                  sh -c "nohup chmod 777 /boot/.IptabLes>/dev/null"
                                                                                                                                                  1⤵
                                                                                                                                                    PID:634
                                                                                                                                                    • /usr/bin/nohup
                                                                                                                                                      nohup chmod 777 /boot/.IptabLes
                                                                                                                                                      2⤵
                                                                                                                                                        PID:635
                                                                                                                                                      • /usr/local/sbin/chmod
                                                                                                                                                        chmod 777 /boot/.IptabLes
                                                                                                                                                        2⤵
                                                                                                                                                          PID:635
                                                                                                                                                        • /usr/local/bin/chmod
                                                                                                                                                          chmod 777 /boot/.IptabLes
                                                                                                                                                          2⤵
                                                                                                                                                            PID:635
                                                                                                                                                          • /usr/sbin/chmod
                                                                                                                                                            chmod 777 /boot/.IptabLes
                                                                                                                                                            2⤵
                                                                                                                                                              PID:635
                                                                                                                                                            • /usr/bin/chmod
                                                                                                                                                              chmod 777 /boot/.IptabLes
                                                                                                                                                              2⤵
                                                                                                                                                                PID:635
                                                                                                                                                              • /sbin/chmod
                                                                                                                                                                chmod 777 /boot/.IptabLes
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:635
                                                                                                                                                                • /bin/chmod
                                                                                                                                                                  chmod 777 /boot/.IptabLes
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:635
                                                                                                                                                                • /bin/sh
                                                                                                                                                                  sh -c "nohup chmod 777 /boot/IptabLes>/dev/null"
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:636
                                                                                                                                                                    • /usr/bin/nohup
                                                                                                                                                                      nohup chmod 777 /boot/IptabLes
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:637
                                                                                                                                                                      • /usr/local/sbin/chmod
                                                                                                                                                                        chmod 777 /boot/IptabLes
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:637
                                                                                                                                                                        • /usr/local/bin/chmod
                                                                                                                                                                          chmod 777 /boot/IptabLes
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:637
                                                                                                                                                                          • /usr/sbin/chmod
                                                                                                                                                                            chmod 777 /boot/IptabLes
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:637
                                                                                                                                                                            • /usr/bin/chmod
                                                                                                                                                                              chmod 777 /boot/IptabLes
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:637
                                                                                                                                                                              • /sbin/chmod
                                                                                                                                                                                chmod 777 /boot/IptabLes
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:637
                                                                                                                                                                                • /bin/chmod
                                                                                                                                                                                  chmod 777 /boot/IptabLes
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:637
                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                  sh -c /etc/rc2.d/S55IptabLes
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:638
                                                                                                                                                                                    • /etc/rc2.d/S55IptabLes
                                                                                                                                                                                      /etc/rc2.d/S55IptabLes
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:639
                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                      sh -c /etc/rc3.d/S55IptabLes
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:640
                                                                                                                                                                                        • /etc/rc3.d/S55IptabLes
                                                                                                                                                                                          /etc/rc3.d/S55IptabLes
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:641
                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                          sh -c /etc/rc4.d/S55IptabLes
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:642
                                                                                                                                                                                            • /etc/rc4.d/S55IptabLes
                                                                                                                                                                                              /etc/rc4.d/S55IptabLes
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:643
                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                              sh -c /etc/rc5.d/S55IptabLes
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:644
                                                                                                                                                                                                • /etc/rc5.d/S55IptabLes
                                                                                                                                                                                                  /etc/rc5.d/S55IptabLes
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:645
                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                  sh -c "/boot/IptabLes xxxx xxx"
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:646
                                                                                                                                                                                                    • /boot/IptabLes
                                                                                                                                                                                                      /boot/IptabLes xxxx xxx
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:647
                                                                                                                                                                                                        • /boot/.IptabLes
                                                                                                                                                                                                          /boot/.IptabLes
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:648
                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                        sh -c "nohup sh /delxxaazz>/dev/null&"
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:650
                                                                                                                                                                                                          • /usr/bin/nohup
                                                                                                                                                                                                            nohup sh /delxxaazz
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:655
                                                                                                                                                                                                            • /usr/local/sbin/sh
                                                                                                                                                                                                              sh /delxxaazz
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:655
                                                                                                                                                                                                              • /usr/local/bin/sh
                                                                                                                                                                                                                sh /delxxaazz
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:655
                                                                                                                                                                                                                • /usr/sbin/sh
                                                                                                                                                                                                                  sh /delxxaazz
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:655
                                                                                                                                                                                                                  • /usr/bin/sh
                                                                                                                                                                                                                    sh /delxxaazz
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:655
                                                                                                                                                                                                                    • /sbin/sh
                                                                                                                                                                                                                      sh /delxxaazz
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:655
                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                        sh /delxxaazz
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:655
                                                                                                                                                                                                                          • /bin/sleep
                                                                                                                                                                                                                            sleep 3
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:656
                                                                                                                                                                                                                            • /bin/sleep
                                                                                                                                                                                                                              sleep 1
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:657
                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                rm -f /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Writes file to tmp directory
                                                                                                                                                                                                                                PID:658
                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                rm -rf /delxxaazz
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:659

                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                            Downloads