Analysis
-
max time kernel
0s -
max time network
102s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
submitted
17-06-2022 07:13
General
-
Target
3d8d25e2204f25260c42a29ad2f6c5c21f18f90ce80cb338bc678e242fba68cd
-
Size
4.5MB
-
MD5
cc92abe1b08778b79d0369caf016c97e
-
SHA1
fe47cccdfc35063c6e54786ea704cad5addce866
-
SHA256
3d8d25e2204f25260c42a29ad2f6c5c21f18f90ce80cb338bc678e242fba68cd
-
SHA512
9e2477d18fc560978a422a50b32b71707def72a7d2470b75b6672fc2ba8584ecf5fe618108748b002312ae6d072f255f0981a26ee6ea788d4acdd5f6f7e32ede
Score
10/10
Malware Config
Signatures
-
suricata: ET MALWARE ZHtrap CnC Checkin
suricata: ET MALWARE ZHtrap CnC Checkin
-
suricata: ET MALWARE ZHtrap CnC Response - Connection Successfully Established
suricata: ET MALWARE ZHtrap CnC Response - Connection Successfully Established
-
Deletes system logs 1 TTPs 3 IoCs
-
Modifies init.d 1 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
-
Write file to user bin folder 1 TTPs 2 IoCs
Processes
-
./3d8d25e2204f25260c42a29ad2f6c5c21f18f90ce80cb338bc678e242fba68cd./3d8d25e2204f25260c42a29ad2f6c5c21f18f90ce80cb338bc678e242fba68cd1⤵
- Deletes system logs
- Modifies init.d
- Write file to user bin folder