Analysis
-
max time kernel
14105s -
max time network
152s -
platform
linux_mipsel -
resource
debian9-mipsel-en-20211208 -
submitted
20-05-2022 23:02
Static task
static1
Behavioral task
behavioral1
Sample
de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb
Resource
debian9-mipsel-en-20211208
General
-
Target
de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb
-
Size
358KB
-
MD5
639fc83ecdf903c5565b0328d4375e12
-
SHA1
7cbfed277c84d45641fc19852fd27193de2cffc8
-
SHA256
de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb
-
SHA512
3d2b151d71f72dc80db66697a834df6bba4e7a3bfeb048c992ad564dce5b432658b10f50c351b69e6563e75c502440d0d4720ca769d99ae4dd15e45ee7ff1cec
Malware Config
Signatures
-
Attempts to identify hypervisor via CPU configuration 1 TTPs 2 IoCs
Checks CPU information for indicators that the system is a virtual machine.
Processes:
de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bbdescription ioc process /proc/cpuinfo /proc/cpuinfo de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb /proc/cpuinfo /proc/cpuinfo -
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
Processes:
description ioc /etc/hosts /etc/hosts -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
-
Processes:
seddescription ioc process /etc/init.d/boot.local /etc/init.d/boot.local sed -
Modifies rc script 1 TTPs 4 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
Processes:
sedsedsedseddescription ioc process /etc/rc.local /etc/rc.local sed /etc/rc.local /etc/rc.local sed /etc/rc.local /etc/rc.local sed /etc/rc.d/rc.local /etc/rc.d/rc.local sed -
Reads runtime system information 8 IoCs
Reads data from /proc virtual filesystem.
Processes:
sedsedsedsedsedmvseddescription ioc process /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/stat /proc/stat /proc/filesystems /proc/filesystems mv /proc/filesystems /proc/filesystems sed
Processes
-
./de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb./de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb1⤵
- Attempts to identify hypervisor via CPU configuration
-
/bin/sh/bin/sh -c "chmod +x /etc/rc.local"2⤵
-
/bin/chmodchmod +x /etc/rc.local3⤵
-
/bin/sh/bin/sh -c "mv /tmp/de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb /etc/de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb"2⤵
-
/bin/mvmv /tmp/de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb /etc/de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb3⤵
- Reads runtime system information
-
/bin/sh/bin/sh -c "cd /etc;chmod 777 de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb"2⤵
-
/bin/chmodchmod 777 de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb3⤵
-
/bin/sh/bin/sh -c "sed -i -e '/exit/d' /etc/rc.local"2⤵
-
/bin/sedsed -i -e /exit/d /etc/rc.local3⤵
- Modifies rc script
- Reads runtime system information
-
/bin/sh/bin/sh -c "sed -i -e '/^ | | \$/d' /etc/rc.local"2⤵
-
/bin/sedsed -i -e "/^ | | \$/d" /etc/rc.local3⤵
- Reads runtime system information
-
/bin/sh/bin/sh -c "sed -i -e '/de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb/d' /etc/rc.local"2⤵
-
/bin/sedsed -i -e /de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb/d /etc/rc.local3⤵
- Modifies rc script
- Reads runtime system information
-
/bin/sh/bin/sh -c "sed -i -e '2 i/etc/de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb reboot' /etc/rc.local"2⤵
-
/bin/sedsed -i -e "2 i/etc/de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb reboot" /etc/rc.local3⤵
- Modifies rc script
- Reads runtime system information
-
/bin/sh/bin/sh -c "sed -i -e '2 i/etc/de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb start' /etc/rc.d/rc.local"2⤵
-
/bin/sedsed -i -e "2 i/etc/de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb start" /etc/rc.d/rc.local3⤵
- Modifies rc script
- Reads runtime system information
-
/bin/sh/bin/sh -c "sed -i -e '2 i/etc/de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb start' /etc/init.d/boot.local"2⤵
-
/bin/sedsed -i -e "2 i/etc/de959af4e13c5a0b9799ffecbbee43a30f21763f784262addc650a41ca12f2bb start" /etc/init.d/boot.local3⤵
- Modifies init.d
- Reads runtime system information