3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437

General

Target
3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437
Size 611KB
Sample220607-t86wpacfd2
SHA256 3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437
MD5 1c0d11325276488a3506632a997f7625
SHA1 30ced396120f6b1a33826e35f898290e423b98ed
SHA512 c14eb28e075fe981047d28b06ea20b487e99ebf51480f777324605a6d78ca32bca26400742c368e3abf15c1b0ab73bf00b3c4b9fcbee5e673751758051022571
MD5 SHA1 SHA512

Score

10^/10

suricata: ET MALWARE DDoS.XOR Checkin
suricata: ET MALWARE DDoS.XOR Checkin
suricata

Writes file to system bin folder 1 TTPs 3 IoCs

Hijack Execution Flow

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Scheduled Task

description	ioc	Process
/etc/crontab	/etc/crontab	sed
/etc/crontab	/etc/crontab	sh

Modifies rc script 1 TTPs 12 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

Boot or Logon Autostart Execution

description	ioc	Process
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc2.d/S903b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437	/etc/rc2.d/S903b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437	Process not Found
/etc/rc5.d/S903b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437	/etc/rc5.d/S903b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437	Process not Found
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d
/etc/rc1.d/S903b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437	/etc/rc1.d/S903b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437	Process not Found
/etc/rc3.d/S903b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437	/etc/rc3.d/S903b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437	Process not Found
/etc/rc4.d/S903b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437	/etc/rc4.d/S903b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437	Process not Found
/etc/rc0.d/	/etc/rc0.d/	update-rc.d

Write file to user bin folder 1 TTPs 4 IoCs

Hijack Execution Flow

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

./3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437
./3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437
1⤵
PID:581

/bin/chkconfig
chkconfig --add 3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437
1⤵
PID:584

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:587
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:588

/sbin/chkconfig
chkconfig --add 3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437
1⤵
PID:584

/usr/bin/chkconfig
chkconfig --add 3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437
1⤵
PID:584

/usr/sbin/chkconfig
chkconfig --add 3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437
1⤵
PID:584

/usr/local/bin/chkconfig
chkconfig --add 3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437
1⤵
PID:584

/usr/local/sbin/chkconfig
chkconfig --add 3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437
1⤵
PID:584

/usr/X11R6/bin/chkconfig
chkconfig --add 3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437
1⤵
PID:584

/bin/update-rc.d
update-rc.d 3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437 defaults
1⤵
PID:586

/sbin/update-rc.d
update-rc.d 3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437 defaults
1⤵
PID:586

/usr/bin/update-rc.d
update-rc.d 3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437 defaults
1⤵
PID:586

/usr/sbin/update-rc.d
update-rc.d 3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437 defaults
1⤵
- Modifies rc script
- Write file to user bin folder
PID:586
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:592