General
- Target 24b5cdfc8de10c99929b230f0dcbf7fcefe9de448eeb6c75675cfe6c44633073
- Size 4.6MB
- Sample220617-h2mnpaddf2
- SHA256 24b5cdfc8de10c99929b230f0dcbf7fcefe9de448eeb6c75675cfe6c44633073
Score
10/10
Malware Config
Targets
-
- Target 24b5cdfc8de10c99929b230f0dcbf7fcefe9de448eeb6c75675cfe6c44633073
- Size 4.6MB
- SHA256 24b5cdfc8de10c99929b230f0dcbf7fcefe9de448eeb6c75675cfe6c44633073
Score10/10-
suricata: ET MALWARE ZHtrap CnC Checkin
suricata: ET MALWARE ZHtrap CnC Checkin
-
suricata: ET MALWARE ZHtrap CnC Response - Connection Successfully Established
suricata: ET MALWARE ZHtrap CnC Response - Connection Successfully Established
-
Writes file to system bin folder
-
Modifies init.d
Adds/modifies system service, likely for persistence.
-
Write file to user bin folder
-
Reads CPU attributes
-
Enumerates kernel/hardware configuration
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory
Malware often drops required files in the /tmp directory.