Overview

overview

10

Static

static

10

f48d2e608f...ac03b3

linux_amd64

10

Resubmissions

02-06-2022 16:54

220602-vewz3aghc6 10

05-01-2022 12:00

220105-n6djgaaehl 1

Analysis

  • max time kernel
    0s
  • max time network
    150s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • submitted
    02-06-2022 16:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f48d2e608faeb0747b32205489e8ca88a3b10ecfd3c2cc2ff31fabf11fac03b3

  • Size

    546KB

  • MD5

    429164dbad09cd108d22105e628a3daa

  • SHA1

    85cd14daabf7ffa7dfec07fd50e8e82eca9b5855

  • SHA256

    f48d2e608faeb0747b32205489e8ca88a3b10ecfd3c2cc2ff31fabf11fac03b3

  • SHA512

    0bac37f71c3a5062884e65d3c0b4f3466b73cb8611e300662f6ecfb80d44e8a724c845c55746d5341965b2b56c62f366822f86cd4113df80f7fca85e445b5923

Score
10/10
persistencesuricata

Malware Config

Signatures

  • suricata: ET MALWARE DDoS.XOR Checkin via HTTP

    suricata: ET MALWARE DDoS.XOR Checkin via HTTP

    suricata
  • Writes file to system bin folder 1 TTPs 25 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  • Modifies init.d 1 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 1 TTPs 5 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • ./f48d2e608faeb0747b32205489e8ca88a3b10ecfd3c2cc2ff31fabf11fac03b3
    ./f48d2e608faeb0747b32205489e8ca88a3b10ecfd3c2cc2ff31fabf11fac03b3
    1⤵
      PID:570
    • /bin/bjhbbuiaxhy
      /bin/bjhbbuiaxhy
      1⤵
        PID:574
      • /bin/lqqjymnmzisr
        /bin/lqqjymnmzisr -d 575
        1⤵
          PID:579
        • /bin/doashveu
          /bin/doashveu -d 575
          1⤵
            PID:582
          • /bin/dxjkdicbxixyy
            /bin/dxjkdicbxixyy -d 575
            1⤵
              PID:589
            • /bin/zbmtnfja
              /bin/zbmtnfja -d 575
              1⤵
                PID:592
              • /bin/xachyhbzm
                /bin/xachyhbzm -d 575
                1⤵
                  PID:595
                • /bin/kwfuairifqjor
                  /bin/kwfuairifqjor -d 575
                  1⤵
                    PID:598
                  • /bin/cmahxcrwcwd
                    /bin/cmahxcrwcwd -d 575
                    1⤵
                      PID:601
                    • /bin/fgbriop
                      /bin/fgbriop -d 575
                      1⤵
                        PID:604
                      • /bin/irxcceuntnzvb
                        /bin/irxcceuntnzvb -d 575
                        1⤵
                          PID:607
                        • /bin/fydyuiuakbi
                          /bin/fydyuiuakbi -d 575
                          1⤵
                            PID:610
                          • /bin/ejgodgqfkms
                            /bin/ejgodgqfkms -d 575
                            1⤵
                              PID:613
                            • /bin/ztbavgya
                              /bin/ztbavgya -d 575
                              1⤵
                                PID:616
                              • /bin/vkdvvef
                                /bin/vkdvvef -d 575
                                1⤵
                                  PID:619
                                • /bin/zypihdln
                                  /bin/zypihdln -d 575
                                  1⤵
                                    PID:622
                                  • /bin/sximdigek
                                    /bin/sximdigek -d 575
                                    1⤵
                                      PID:625
                                    • /bin/dsgovdlckwbjnj
                                      /bin/dsgovdlckwbjnj -d 575
                                      1⤵
                                        PID:628
                                      • /bin/sxdoraxe
                                        /bin/sxdoraxe -d 575
                                        1⤵
                                          PID:631
                                        • /bin/hmjtpxeusmkprx
                                          /bin/hmjtpxeusmkprx -d 575
                                          1⤵
                                            PID:634
                                          • /bin/ctsliebb
                                            /bin/ctsliebb -d 575
                                            1⤵
                                              PID:637
                                            • /bin/gpuioamxmxr
                                              /bin/gpuioamxmxr -d 575
                                              1⤵
                                                PID:640
                                              • /bin/apkkediwf
                                                /bin/apkkediwf -d 575
                                                1⤵
                                                  PID:643
                                                • /bin/qsmuvnxbeuktu
                                                  /bin/qsmuvnxbeuktu -d 575
                                                  1⤵
                                                    PID:646

                                                  Network

                                                  MITRE ATT&CK Enterprise v6

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads