47c0af3e024fb5b38a97768bb9f6dce954fe358ce7f24c46dcc23689e8687a70

Resubmissions

02-06-2022 16:55

220602-vfcmtaghc7 10

08-03-2022 22:23

220308-2ar9msbef2 9

Analysis

max time kernel
0s
max time network
32s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
submitted
02-06-2022 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x.o
Size

611KB
MD5

d46dd322e3cefa2b6eda0c96b84f7611
SHA1

5dae4f419d23a4d5f42d4ea0e5d67382d26b34ca
SHA256

47c0af3e024fb5b38a97768bb9f6dce954fe358ce7f24c46dcc23689e8687a70
SHA512

8c3047a1ffa39982c39cb04d2fad34a49502711a004448176945c60a1aeed177676cc920ef02ddb81c1205935ed05ca46630cee165d2c36fdc08059264f0dc5d

Score

9^/10

persistence

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 4 IoCs

Hijack Execution Flow
T1574

Processes:

description ioc

/bin/zbtsamkkqh /bin/zbtsamkkqh
/bin/buqfoexumq /bin/buqfoexumq
/bin/jkhxysnsjy /bin/jkhxysnsjy
/bin/oifsrwncpe /bin/oifsrwncpe
Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task
T1053

Processes:

sedsh

description ioc process

/etc/crontab /etc/crontab sed
/etc/crontab /etc/crontab sh

description	ioc
/bin/zbtsamkkqh	/bin/zbtsamkkqh
/bin/buqfoexumq	/bin/buqfoexumq
/bin/jkhxysnsjy	/bin/jkhxysnsjy
/bin/oifsrwncpe	/bin/oifsrwncpe

description	ioc	process
/etc/crontab	/etc/crontab	sed
/etc/crontab	/etc/crontab	sh

Modifies rc script 1 TTPs 12 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

Processes:

update-rc.d

description	ioc
/etc/rc2.d/S90x.o	/etc/rc2.d/S90x.o
/etc/rc3.d/S90x.o	/etc/rc3.d/S90x.o
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc1.d/S90x.o	/etc/rc1.d/S90x.o
/etc/rc4.d/S90x.o	/etc/rc4.d/S90x.o
/etc/rc5.d/S90x.o	/etc/rc5.d/S90x.o
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d

Write file to user bin folder 1 TTPs 5 IoCs

Hijack Execution Flow

T1574

Processes:

update-rc.d

description	ioc
/usr/bin/buqfoexumq	/usr/bin/buqfoexumq
/usr/bin/jkhxysnsjy	/usr/bin/jkhxysnsjy
/usr/bin/oifsrwncpe	/usr/bin/oifsrwncpe
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d
/usr/bin/zbtsamkkqh	/usr/bin/zbtsamkkqh

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

Processes:

systemctlsed

description	ioc	process
/proc/1/environ	/proc/1/environ	systemctl
/proc/1/sched	/proc/1/sched	systemctl
/proc/cmdline	/proc/cmdline	systemctl
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	systemctl
/proc/self/stat	/proc/self/stat	systemctl
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl

Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.

Processes:

description ioc

/tmp/jkhxysnsjy /tmp/jkhxysnsjy
/tmp/oifsrwncpe /tmp/oifsrwncpe
/tmp/zbtsamkkqh /tmp/zbtsamkkqh
/tmp/buqfoexumq /tmp/buqfoexumq

description	ioc
/tmp/jkhxysnsjy	/tmp/jkhxysnsjy
/tmp/oifsrwncpe	/tmp/oifsrwncpe
/tmp/zbtsamkkqh	/tmp/zbtsamkkqh
/tmp/buqfoexumq	/tmp/buqfoexumq

./x.o
./x.o
1⤵
PID:576

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:582
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:583

/bin/chkconfig
chkconfig --add x.o
1⤵
PID:579

/sbin/chkconfig
chkconfig --add x.o
1⤵
PID:579

/usr/bin/chkconfig
chkconfig --add x.o
1⤵
PID:579

/usr/sbin/chkconfig
chkconfig --add x.o
1⤵
PID:579

/usr/local/bin/chkconfig
chkconfig --add x.o
1⤵
PID:579

/usr/local/sbin/chkconfig
chkconfig --add x.o
1⤵
PID:579

/usr/X11R6/bin/chkconfig
chkconfig --add x.o
1⤵
PID:579

/bin/update-rc.d
update-rc.d x.o defaults
1⤵
PID:581

/sbin/update-rc.d
update-rc.d x.o defaults
1⤵
PID:581

/usr/bin/update-rc.d
update-rc.d x.o defaults
1⤵
PID:581

/usr/sbin/update-rc.d
update-rc.d x.o defaults
1⤵
- Modifies rc script
- Write file to user bin folder
PID:581
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:587

/usr/bin/buqfoexumq
/usr/bin/buqfoexumq "grep \"A\"" 577
1⤵
PID:608

/usr/bin/buqfoexumq
/usr/bin/buqfoexumq "sleep 1" 577
1⤵
PID:611

/usr/bin/buqfoexumq
/usr/bin/buqfoexumq "netstat -an" 577
1⤵
PID:614

/usr/bin/buqfoexumq
/usr/bin/buqfoexumq pwd 577
1⤵
PID:617

/usr/bin/buqfoexumq
/usr/bin/buqfoexumq su 577
1⤵
PID:620

/usr/bin/jkhxysnsjy
/usr/bin/jkhxysnsjy id 577
1⤵
PID:623

/usr/bin/jkhxysnsjy
/usr/bin/jkhxysnsjy "route -n" 577
1⤵
PID:626

/usr/bin/jkhxysnsjy
/usr/bin/jkhxysnsjy sh 577
1⤵
PID:629

/usr/bin/jkhxysnsjy
/usr/bin/jkhxysnsjy id 577
1⤵
PID:632

/usr/bin/jkhxysnsjy
/usr/bin/jkhxysnsjy "ifconfig eth0" 577
1⤵
PID:635

/usr/bin/oifsrwncpe
/usr/bin/oifsrwncpe ls 577
1⤵
PID:638

/usr/bin/oifsrwncpe
/usr/bin/oifsrwncpe pwd 577
1⤵
PID:641

/usr/bin/oifsrwncpe
/usr/bin/oifsrwncpe who 577
1⤵
PID:644

/usr/bin/oifsrwncpe
/usr/bin/oifsrwncpe top 577
1⤵
PID:647

/usr/bin/oifsrwncpe
/usr/bin/oifsrwncpe "ps -ef" 577
1⤵
PID:650

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task

T1053

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads