Analysis
-
max time kernel
12472s -
max time network
151s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
submitted
02-05-2022 01:19
Static task
static1
Behavioral task
behavioral1
Sample
59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1
-
Size
699KB
-
MD5
a3a70a53a5d4e4a4ef24c0f7e0757490
-
SHA1
94efef21f765a4c6af2219760fb374b786006308
-
SHA256
59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1
-
SHA512
85634593967a3932a3df5e2525b844194d6cbae15a662dbfc626e1f51c542f9f1e1058659ff13578f96a3057c4efb15471af968226aedcb0b289953f53310682
Malware Config
Signatures
-
Processes:
rmdescription ioc process /etc/init.d/IptabLes /etc/init.d/IptabLes rm -
Modifies rc script 1 TTPs 11 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
Processes:
rmrmrmrmrmrmrmdescription ioc process /etc/rc6.d/*IptabLes /etc/rc6.d/*IptabLes rm /etc/rc2.d/S55IptabLes /etc/rc2.d/S55IptabLes /etc/rc5.d/S55IptabLes /etc/rc5.d/S55IptabLes /etc/rc3.d/*IptabLes /etc/rc3.d/*IptabLes rm /etc/rc0.d/*IptabLes /etc/rc0.d/*IptabLes rm /etc/rc5.d/*IptabLes /etc/rc5.d/*IptabLes rm /etc/rc3.d/S55IptabLes /etc/rc3.d/S55IptabLes /etc/rc4.d/S55IptabLes /etc/rc4.d/S55IptabLes /etc/rc4.d/*IptabLes /etc/rc4.d/*IptabLes rm /etc/rc1.d/*IptabLes /etc/rc1.d/*IptabLes rm /etc/rc2.d/*IptabLes /etc/rc2.d/*IptabLes rm -
Reads CPU attributes 1 TTPs 10 IoCs
Processes:
pskillpskillpspspspskillkilldescription ioc process /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online kill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online kill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online kill /sys/devices/system/cpu/online /sys/devices/system/cpu/online kill -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
pspspspsdescription ioc process /proc/5/status /proc/5/status ps /proc/157/status /proc/157/status ps /proc/165/stat /proc/165/stat ps /proc/193/status /proc/193/status ps /proc/17/status /proc/17/status ps /proc/592/stat /proc/592/stat ps /proc/31/status /proc/31/status ps /proc/18/status /proc/18/status ps /proc/161/status /proc/161/status ps /proc/418/status /proc/418/status ps /proc/23/status /proc/23/status ps /proc/129/status /proc/129/status ps /proc/369/cmdline /proc/369/cmdline ps /proc/98/status /proc/98/status ps /proc/20/status /proc/20/status ps /proc/583/stat /proc/583/stat ps /proc/159/stat /proc/159/stat ps /proc/418/stat /proc/418/stat ps /proc/363/status /proc/363/status ps /proc/34/status /proc/34/status ps /proc/2/stat /proc/2/stat ps /proc/14/stat /proc/14/stat ps /proc/286/status /proc/286/status ps /proc/82/stat /proc/82/stat ps /proc/11/status /proc/11/status ps /proc/17/status /proc/17/status ps /proc/153/stat /proc/153/stat ps /proc/13/cmdline /proc/13/cmdline ps /proc/168/cmdline /proc/168/cmdline ps /proc/9/status /proc/9/status ps /proc/252/cmdline /proc/252/cmdline ps /proc/24/status /proc/24/status ps /proc/158/stat /proc/158/stat ps /proc/meminfo /proc/meminfo ps /proc/1/cmdline /proc/1/cmdline ps /proc/29/cmdline /proc/29/cmdline ps /proc/159/stat /proc/159/stat ps /proc/155/stat /proc/155/stat ps /proc/4/status /proc/4/status ps /proc/83/stat /proc/83/stat ps /proc/167/stat /proc/167/stat ps /proc/82/cmdline /proc/82/cmdline ps /proc/34/status /proc/34/status ps /proc/30/cmdline /proc/30/cmdline ps /proc/363/status /proc/363/status ps /proc/192/status /proc/192/status ps /proc/7/stat /proc/7/stat ps /proc/14/status /proc/14/status ps /proc/uptime /proc/uptime ps /proc/591/stat /proc/591/stat ps /proc/36/stat /proc/36/stat ps /proc/98/status /proc/98/status ps /proc/157/stat /proc/157/stat ps /proc/586/cmdline /proc/586/cmdline ps /proc/192/cmdline /proc/192/cmdline ps /proc/80/status /proc/80/status ps /proc/352/cmdline /proc/352/cmdline ps /proc/583/stat /proc/583/stat ps /proc/115/stat /proc/115/stat ps /proc/352/stat /proc/352/stat ps /proc/167/stat /proc/167/stat ps /proc/9/status /proc/9/status ps /proc/10/status /proc/10/status ps /proc/157/status /proc/157/status ps -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes:
rmcprmdescription ioc process /tmp/IptabLes /tmp/IptabLes rm /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 cp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 rm
Processes
-
./59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1./59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c11⤵
-
/bin/shsh -c "nohup sh /delallmykkk>/dev/null"1⤵
-
/usr/bin/nohupnohup sh /delallmykkk2⤵
-
/usr/local/sbin/shsh /delallmykkk2⤵
-
/usr/local/bin/shsh /delallmykkk2⤵
-
/usr/sbin/shsh /delallmykkk2⤵
-
/usr/bin/shsh /delallmykkk2⤵
-
/sbin/shsh /delallmykkk2⤵
-
/bin/shsh /delallmykkk2⤵
-
/bin/grepgrep .IptabLes3⤵
-
/bin/psps -axu3⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "{print \$2}"3⤵
-
/usr/bin/xargsxargs kill -93⤵
-
/usr/local/sbin/killkill -9 5854⤵
-
/usr/local/bin/killkill -9 5854⤵
-
/usr/sbin/killkill -9 5854⤵
-
/usr/bin/killkill -9 5854⤵
-
/sbin/killkill -9 5854⤵
-
/bin/killkill -9 5854⤵
- Reads CPU attributes
-
/bin/psps -axu3⤵
- Reads CPU attributes
- Reads runtime system information
-
/bin/grepgrep .IptabLes3⤵
-
/usr/bin/xargsxargs kill -93⤵
-
/usr/local/sbin/killkill -9 5904⤵
-
/usr/local/bin/killkill -9 5904⤵
-
/usr/sbin/killkill -9 5904⤵
-
/usr/bin/killkill -9 5904⤵
-
/sbin/killkill -9 5904⤵
-
/bin/killkill -9 5904⤵
- Reads CPU attributes
-
/usr/bin/awkawk "{print \$2}"3⤵
-
/bin/psps -C .IptabLes3⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/xargsxargs kill -93⤵
-
/usr/local/sbin/killkill -9 PID TTY TIME CMD4⤵
-
/usr/local/bin/killkill -9 PID TTY TIME CMD4⤵
-
/usr/sbin/killkill -9 PID TTY TIME CMD4⤵
-
/usr/bin/killkill -9 PID TTY TIME CMD4⤵
-
/sbin/killkill -9 PID TTY TIME CMD4⤵
-
/bin/killkill -9 PID TTY TIME CMD4⤵
- Reads CPU attributes
-
/bin/psps -C .IptabLes3⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/xargsxargs kill -93⤵
-
/usr/local/sbin/killkill -9 PID TTY TIME CMD4⤵
-
/usr/local/bin/killkill -9 PID TTY TIME CMD4⤵
-
/usr/sbin/killkill -9 PID TTY TIME CMD4⤵
-
/usr/bin/killkill -9 PID TTY TIME CMD4⤵
-
/sbin/killkill -9 PID TTY TIME CMD4⤵
-
/bin/killkill -9 PID TTY TIME CMD4⤵
- Reads CPU attributes
-
/bin/psps find / -name "*ptabLes"3⤵
- Reads CPU attributes
-
/usr/bin/xargsxargs rm -f3⤵
-
/usr/local/sbin/rmrm -f4⤵
-
/usr/local/bin/rmrm -f4⤵
-
/usr/sbin/rmrm -f4⤵
-
/usr/bin/rmrm -f4⤵
-
/sbin/rmrm -f4⤵
-
/bin/rmrm -f4⤵
-
/bin/psps find / -name .IptabLes3⤵
- Reads CPU attributes
-
/usr/bin/xargsxargs rm -f3⤵
-
/usr/local/sbin/rmrm -f4⤵
-
/usr/local/bin/rmrm -f4⤵
-
/usr/sbin/rmrm -f4⤵
-
/usr/bin/rmrm -f4⤵
-
/sbin/rmrm -f4⤵
-
/bin/rmrm -f4⤵
-
/bin/rmrm -f /boot/.stabip3⤵
-
/bin/rmrm -f /boot/.IptabLes3⤵
-
/bin/rmrm -f /etc/rc.d/init.d/IptabLes3⤵
-
/bin/rmrm -f /boot/IptabLes3⤵
-
/bin/rmrm -f /tmp/IptabLes3⤵
- Writes file to tmp directory
-
/bin/rmrm -f /usr/.IptabLes3⤵
-
/bin/rmrm -f "/etc/rc.d/rc4.d/*IptabLes"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc1.d/*IptabLes"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc2.d/*IptabLes"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc3.d/*IptabLes"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc0.d/*IptabLes"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc5.d/*IptabLes"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc6.d/*IptabLes"3⤵
-
/bin/rmrm -f /etc/init.d/IptabLes3⤵
- Modifies init.d
-
/bin/rmrm -f "/etc/rc4.d/*IptabLes"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc1.d/*IptabLes"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc2.d/*IptabLes"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc3.d/*IptabLes"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc0.d/*IptabLes"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc5.d/*IptabLes"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc6.d/*IptabLes"3⤵
- Modifies rc script
-
/bin/rmrm -rf /delallmykkk3⤵
-
/bin/shsh -c "nohup cp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /boot/.IptabLes>/dev/null"1⤵
-
/usr/bin/nohupnohup cp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /boot/.IptabLes2⤵
-
/usr/local/sbin/cpcp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /boot/.IptabLes2⤵
-
/usr/local/bin/cpcp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /boot/.IptabLes2⤵
-
/usr/sbin/cpcp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /boot/.IptabLes2⤵
-
/usr/bin/cpcp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /boot/.IptabLes2⤵
-
/sbin/cpcp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /boot/.IptabLes2⤵
-
/bin/cpcp /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c1 /boot/.IptabLes2⤵
- Writes file to tmp directory
-
/bin/shsh -c "nohup chmod 777 /boot/.IptabLes>/dev/null"1⤵
-
/usr/bin/nohupnohup chmod 777 /boot/.IptabLes2⤵
-
/usr/local/sbin/chmodchmod 777 /boot/.IptabLes2⤵
-
/usr/local/bin/chmodchmod 777 /boot/.IptabLes2⤵
-
/usr/sbin/chmodchmod 777 /boot/.IptabLes2⤵
-
/usr/bin/chmodchmod 777 /boot/.IptabLes2⤵
-
/sbin/chmodchmod 777 /boot/.IptabLes2⤵
-
/bin/chmodchmod 777 /boot/.IptabLes2⤵
-
/bin/shsh -c "nohup chmod 777 /boot/IptabLes>/dev/null"1⤵
-
/usr/bin/nohupnohup chmod 777 /boot/IptabLes2⤵
-
/usr/local/sbin/chmodchmod 777 /boot/IptabLes2⤵
-
/usr/local/bin/chmodchmod 777 /boot/IptabLes2⤵
-
/usr/sbin/chmodchmod 777 /boot/IptabLes2⤵
-
/usr/bin/chmodchmod 777 /boot/IptabLes2⤵
-
/sbin/chmodchmod 777 /boot/IptabLes2⤵
-
/bin/chmodchmod 777 /boot/IptabLes2⤵
-
/bin/shsh -c /etc/rc2.d/S55IptabLes1⤵
-
/etc/rc2.d/S55IptabLes/etc/rc2.d/S55IptabLes2⤵
-
/bin/shsh -c /etc/rc3.d/S55IptabLes1⤵
-
/etc/rc3.d/S55IptabLes/etc/rc3.d/S55IptabLes2⤵
-
/bin/shsh -c /etc/rc4.d/S55IptabLes1⤵
-
/etc/rc4.d/S55IptabLes/etc/rc4.d/S55IptabLes2⤵
-
/bin/shsh -c /etc/rc5.d/S55IptabLes1⤵
-
/etc/rc5.d/S55IptabLes/etc/rc5.d/S55IptabLes2⤵
-
/bin/shsh -c "/boot/IptabLes xxxx xxx"1⤵
-
/boot/IptabLes/boot/IptabLes xxxx xxx2⤵
-
/boot/.IptabLes/boot/.IptabLes3⤵
-
/bin/shsh -c "nohup sh /delxxaazz>/dev/null&"1⤵
-
/usr/bin/nohupnohup sh /delxxaazz2⤵
-
/usr/local/sbin/shsh /delxxaazz2⤵
-
/usr/local/bin/shsh /delxxaazz2⤵
-
/usr/sbin/shsh /delxxaazz2⤵
-
/usr/bin/shsh /delxxaazz2⤵
-
/sbin/shsh /delxxaazz2⤵
-
/bin/shsh /delxxaazz2⤵
-
/bin/sleepsleep 33⤵
-
/bin/sleepsleep 13⤵
-
/bin/rmrm -f /tmp/59e9a55a03b24accd71f8503e2e24fa7d430ec758c8baebb21a0887dcc2d43c13⤵
- Writes file to tmp directory
-
/bin/rmrm -rf /delxxaazz3⤵