Analysis
-
max time kernel
16468s -
max time network
156s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
submitted
17-06-2022 07:29
General
-
Target
3a79225b5d6e1726e24b18ee35ad2a1b3656de80f4931d9fbd6ec3d7d9c7438d
-
Size
4.1MB
-
MD5
bc81eac9992a160197188e614a30883a
-
SHA1
75855deba701913f65968e10050134b8ff5c8e9a
-
SHA256
3a79225b5d6e1726e24b18ee35ad2a1b3656de80f4931d9fbd6ec3d7d9c7438d
-
SHA512
362c6d10e1f54f6a4575cdcab3730cedb8141b321d66523b3959cc7e8b1fe09ac6b156bc0c1924172e36076a5a19c30efd8bff10e8a70421a18808ddeca22790
Score
10/10
Malware Config
Signatures
-
suricata: ET MALWARE ZHtrap CnC Checkin
suricata: ET MALWARE ZHtrap CnC Checkin
-
suricata: ET MALWARE ZHtrap CnC Response - Connection Successfully Established
suricata: ET MALWARE ZHtrap CnC Response - Connection Successfully Established
-
Writes file to system bin folder 1 TTPs 13 IoCs
-
Modifies init.d 1 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
-
Write file to user bin folder 1 TTPs 1 IoCs
-
Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
./3a79225b5d6e1726e24b18ee35ad2a1b3656de80f4931d9fbd6ec3d7d9c7438d./3a79225b5d6e1726e24b18ee35ad2a1b3656de80f4931d9fbd6ec3d7d9c7438d1⤵
- Modifies init.d
- Write file to user bin folder
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
-
/usr/bin/find/usr/bin/find / -writable2⤵
- Writes file to system bin folder
- Reads runtime system information
-