Analysis

  • max time kernel
    0s
  • max time network
    31s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • submitted
    07-07-2022 10:34

General

  • Target

    45deebda9ff6b01eaeb6961b22066709f7df31c4e5f53acc76c3488483807f7e

  • Size

    611KB

  • MD5

    63877c8af701e337108a87181e13a855

  • SHA1

    2c778383d1e411a83415d6d43f6ca6699248f8ec

  • SHA256

    45deebda9ff6b01eaeb6961b22066709f7df31c4e5f53acc76c3488483807f7e

  • SHA512

    835d019e77b8200b738a788bb3e575854816293a5dd1a36006698f8b467feff55a9099da94a46a7176b470810b90aae26ba8cc0c3fdd933fe7c849b1d3348a2a

Score
10/10

Malware Config

Signatures

  • suricata: ET MALWARE DDoS.XOR Checkin

    suricata: ET MALWARE DDoS.XOR Checkin

  • suricata: ET MALWARE DDoS.XOR Checkin via HTTP

    suricata: ET MALWARE DDoS.XOR Checkin via HTTP

  • Writes file to system bin folder 1 TTPs 3 IoCs
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Modifies rc script 1 TTPs 12 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Write file to user bin folder 1 TTPs 4 IoCs
  • Reads runtime system information 7 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • ./45deebda9ff6b01eaeb6961b22066709f7df31c4e5f53acc76c3488483807f7e
    ./45deebda9ff6b01eaeb6961b22066709f7df31c4e5f53acc76c3488483807f7e
    1⤵
      PID:593
    • /bin/chkconfig
      chkconfig --add 45deebda9ff6b01eaeb6961b22066709f7df31c4e5f53acc76c3488483807f7e
      1⤵
        PID:596
      • /sbin/chkconfig
        chkconfig --add 45deebda9ff6b01eaeb6961b22066709f7df31c4e5f53acc76c3488483807f7e
        1⤵
          PID:596
        • /usr/bin/chkconfig
          chkconfig --add 45deebda9ff6b01eaeb6961b22066709f7df31c4e5f53acc76c3488483807f7e
          1⤵
            PID:596
          • /usr/sbin/chkconfig
            chkconfig --add 45deebda9ff6b01eaeb6961b22066709f7df31c4e5f53acc76c3488483807f7e
            1⤵
              PID:596
            • /usr/local/bin/chkconfig
              chkconfig --add 45deebda9ff6b01eaeb6961b22066709f7df31c4e5f53acc76c3488483807f7e
              1⤵
                PID:596
              • /usr/local/sbin/chkconfig
                chkconfig --add 45deebda9ff6b01eaeb6961b22066709f7df31c4e5f53acc76c3488483807f7e
                1⤵
                  PID:596
                • /usr/X11R6/bin/chkconfig
                  chkconfig --add 45deebda9ff6b01eaeb6961b22066709f7df31c4e5f53acc76c3488483807f7e
                  1⤵
                    PID:596
                  • /bin/sh
                    sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
                    1⤵
                    • Creates/modifies Cron job
                    PID:599
                    • /bin/sed
                      sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
                      2⤵
                      • Creates/modifies Cron job
                      • Reads runtime system information
                      PID:600
                  • /bin/update-rc.d
                    update-rc.d 45deebda9ff6b01eaeb6961b22066709f7df31c4e5f53acc76c3488483807f7e defaults
                    1⤵
                      PID:598
                    • /sbin/update-rc.d
                      update-rc.d 45deebda9ff6b01eaeb6961b22066709f7df31c4e5f53acc76c3488483807f7e defaults
                      1⤵
                        PID:598
                      • /usr/bin/update-rc.d
                        update-rc.d 45deebda9ff6b01eaeb6961b22066709f7df31c4e5f53acc76c3488483807f7e defaults
                        1⤵
                          PID:598
                        • /usr/sbin/update-rc.d
                          update-rc.d 45deebda9ff6b01eaeb6961b22066709f7df31c4e5f53acc76c3488483807f7e defaults
                          1⤵
                          • Modifies rc script
                          • Write file to user bin folder
                          PID:598
                          • /bin/systemctl
                            systemctl daemon-reload
                            2⤵
                            • Reads runtime system information
                            PID:605
                        • /usr/bin/kiqfzuiztr
                          /usr/bin/kiqfzuiztr ls 594
                          1⤵
                            PID:606
                          • /usr/bin/kiqfzuiztr
                            /usr/bin/kiqfzuiztr "netstat -antop" 594
                            1⤵
                              PID:624
                            • /usr/bin/kiqfzuiztr
                              /usr/bin/kiqfzuiztr "sleep 1" 594
                              1⤵
                                PID:627
                              • /usr/bin/kiqfzuiztr
                                /usr/bin/kiqfzuiztr "echo \"find\"" 594
                                1⤵
                                  PID:630
                                • /usr/bin/kiqfzuiztr
                                  /usr/bin/kiqfzuiztr ls 594
                                  1⤵
                                    PID:637
                                  • /usr/bin/ukobftptht
                                    /usr/bin/ukobftptht top 594
                                    1⤵
                                      PID:640
                                    • /usr/bin/ukobftptht
                                      /usr/bin/ukobftptht ls 594
                                      1⤵
                                        PID:643
                                      • /usr/bin/ukobftptht
                                        /usr/bin/ukobftptht su 594
                                        1⤵
                                          PID:646
                                        • /usr/bin/ukobftptht
                                          /usr/bin/ukobftptht id 594
                                          1⤵
                                            PID:649
                                          • /usr/bin/ukobftptht
                                            /usr/bin/ukobftptht gnome-terminal 594
                                            1⤵
                                              PID:652
                                            • /usr/bin/vdlqcyecow
                                              /usr/bin/vdlqcyecow "grep \"A\"" 594
                                              1⤵
                                                PID:655
                                              • /usr/bin/vdlqcyecow
                                                /usr/bin/vdlqcyecow "netstat -antop" 594
                                                1⤵
                                                  PID:658
                                                • /usr/bin/vdlqcyecow
                                                  /usr/bin/vdlqcyecow "netstat -antop" 594
                                                  1⤵
                                                    PID:661
                                                  • /usr/bin/vdlqcyecow
                                                    /usr/bin/vdlqcyecow su 594
                                                    1⤵
                                                      PID:664
                                                    • /usr/bin/vdlqcyecow
                                                      /usr/bin/vdlqcyecow "echo \"find\"" 594
                                                      1⤵
                                                        PID:667
                                                      • /usr/bin/vtunxjmepi
                                                        /usr/bin/vtunxjmepi ifconfig 594
                                                        1⤵
                                                          PID:670

                                                        Network

                                                        MITRE ATT&CK Enterprise v6

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads