Analysis

  • max time kernel
    0s
  • max time network
    29s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • submitted
    27-05-2022 19:02

General

  • Target

    57ee14b30b52577e4600c1326d6b7918f06521468a4750317047442b4ce01bfc

  • Size

    611KB

  • MD5

    051537e40feb2b11b674dadabad2c505

  • SHA1

    0944493b4fe9d255da9df5816bd9bc6766ffb92f

  • SHA256

    57ee14b30b52577e4600c1326d6b7918f06521468a4750317047442b4ce01bfc

  • SHA512

    33421ca0f404e7c91c1f205c6b34aaecf8a499f213a53afdc0ce66cc235c2cd1d5996a4cd951d2ede9182cc6ee07a7ee301fd6f36dca860bf37268e1d015c1f1

Score
10/10

Malware Config

Signatures

  • suricata: ET MALWARE DDoS.XOR Checkin

    suricata: ET MALWARE DDoS.XOR Checkin

  • suricata: ET MALWARE DDoS.XOR Checkin via HTTP

    suricata: ET MALWARE DDoS.XOR Checkin via HTTP

  • Writes file to system bin folder 1 TTPs 3 IoCs
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Modifies rc script 1 TTPs 12 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

  • Write file to user bin folder 1 TTPs 4 IoCs
  • Reads runtime system information 7 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • ./57ee14b30b52577e4600c1326d6b7918f06521468a4750317047442b4ce01bfc
    ./57ee14b30b52577e4600c1326d6b7918f06521468a4750317047442b4ce01bfc
    1⤵
      PID:571
    • /bin/chkconfig
      chkconfig --add 57ee14b30b52577e4600c1326d6b7918f06521468a4750317047442b4ce01bfc
      1⤵
        PID:574
      • /sbin/chkconfig
        chkconfig --add 57ee14b30b52577e4600c1326d6b7918f06521468a4750317047442b4ce01bfc
        1⤵
          PID:574
        • /usr/bin/chkconfig
          chkconfig --add 57ee14b30b52577e4600c1326d6b7918f06521468a4750317047442b4ce01bfc
          1⤵
            PID:574
          • /usr/sbin/chkconfig
            chkconfig --add 57ee14b30b52577e4600c1326d6b7918f06521468a4750317047442b4ce01bfc
            1⤵
              PID:574
            • /bin/sh
              sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
              1⤵
              • Creates/modifies Cron job
              PID:577
              • /bin/sed
                sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
                2⤵
                • Creates/modifies Cron job
                • Reads runtime system information
                PID:578
            • /usr/local/bin/chkconfig
              chkconfig --add 57ee14b30b52577e4600c1326d6b7918f06521468a4750317047442b4ce01bfc
              1⤵
                PID:574
              • /usr/local/sbin/chkconfig
                chkconfig --add 57ee14b30b52577e4600c1326d6b7918f06521468a4750317047442b4ce01bfc
                1⤵
                  PID:574
                • /usr/X11R6/bin/chkconfig
                  chkconfig --add 57ee14b30b52577e4600c1326d6b7918f06521468a4750317047442b4ce01bfc
                  1⤵
                    PID:574
                  • /bin/update-rc.d
                    update-rc.d 57ee14b30b52577e4600c1326d6b7918f06521468a4750317047442b4ce01bfc defaults
                    1⤵
                      PID:576
                    • /sbin/update-rc.d
                      update-rc.d 57ee14b30b52577e4600c1326d6b7918f06521468a4750317047442b4ce01bfc defaults
                      1⤵
                        PID:576
                      • /usr/bin/update-rc.d
                        update-rc.d 57ee14b30b52577e4600c1326d6b7918f06521468a4750317047442b4ce01bfc defaults
                        1⤵
                          PID:576
                        • /usr/sbin/update-rc.d
                          update-rc.d 57ee14b30b52577e4600c1326d6b7918f06521468a4750317047442b4ce01bfc defaults
                          1⤵
                          • Modifies rc script
                          • Write file to user bin folder
                          PID:576
                          • /bin/systemctl
                            systemctl daemon-reload
                            2⤵
                            • Reads runtime system information
                            PID:582
                        • /usr/bin/qkepdgyxpk
                          /usr/bin/qkepdgyxpk "echo \"find\"" 572
                          1⤵
                            PID:584
                          • /usr/bin/qkepdgyxpk
                            /usr/bin/qkepdgyxpk gnome-terminal 572
                            1⤵
                              PID:601
                            • /usr/bin/qkepdgyxpk
                              /usr/bin/qkepdgyxpk sh 572
                              1⤵
                                PID:605
                              • /usr/bin/qkepdgyxpk
                                /usr/bin/qkepdgyxpk id 572
                                1⤵
                                  PID:608
                                • /usr/bin/qkepdgyxpk
                                  /usr/bin/qkepdgyxpk "sleep 1" 572
                                  1⤵
                                    PID:615
                                  • /usr/bin/yydbqrbixr
                                    /usr/bin/yydbqrbixr who 572
                                    1⤵
                                      PID:618
                                    • /usr/bin/yydbqrbixr
                                      /usr/bin/yydbqrbixr top 572
                                      1⤵
                                        PID:621
                                      • /usr/bin/yydbqrbixr
                                        /usr/bin/yydbqrbixr id 572
                                        1⤵
                                          PID:624
                                        • /usr/bin/yydbqrbixr
                                          /usr/bin/yydbqrbixr su 572
                                          1⤵
                                            PID:627
                                          • /usr/bin/yydbqrbixr
                                            /usr/bin/yydbqrbixr "netstat -an" 572
                                            1⤵
                                              PID:630
                                            • /usr/bin/mdnnzthsio
                                              /usr/bin/mdnnzthsio "route -n" 572
                                              1⤵
                                                PID:633
                                              • /usr/bin/mdnnzthsio
                                                /usr/bin/mdnnzthsio "echo \"find\"" 572
                                                1⤵
                                                  PID:636
                                                • /usr/bin/mdnnzthsio
                                                  /usr/bin/mdnnzthsio "netstat -an" 572
                                                  1⤵
                                                    PID:639
                                                  • /usr/bin/mdnnzthsio
                                                    /usr/bin/mdnnzthsio "ifconfig eth0" 572
                                                    1⤵
                                                      PID:642
                                                    • /usr/bin/mdnnzthsio
                                                      /usr/bin/mdnnzthsio ifconfig 572
                                                      1⤵
                                                        PID:645

                                                      Network

                                                      MITRE ATT&CK Enterprise v6

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads