Analysis
-
max time kernel
0s -
max time network
23s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
submitted
08-07-2022 03:18
Static task
static1
Behavioral task
behavioral1
Sample
4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2
-
Size
611KB
-
MD5
46dce1e4a92eaab92b79ddae319c011a
-
SHA1
2ad5643c3b1ec27e89c934a94df1c0e10d7c13d0
-
SHA256
4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2
-
SHA512
b9d5efafeb61e79e788502821ba97f96a2b843f4b8c6d237135bb63c82efd1ebade8294d1f0cb6830b338f500ac1ef9b8cc6518fe3030f5905fab31378213015
Malware Config
Signatures
-
suricata: ET MALWARE DDoS.XOR Checkin
suricata: ET MALWARE DDoS.XOR Checkin
-
Writes file to system bin folder 1 TTPs 3 IoCs
description ioc /bin/txeiymuiiz /bin/txeiymuiiz /bin/rrrtuppcvx /bin/rrrtuppcvx /bin/rkdinbtgyg /bin/rkdinbtgyg -
Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process /etc/crontab /etc/crontab sed /etc/crontab /etc/crontab sh -
description ioc /etc/init.d/�� /etc/init.d/�� -
Modifies rc script 1 TTPs 17 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process /etc/rc1.d/S904235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2 /etc/rc1.d/S904235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2 Process not Found /etc/rc2.d/S904235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2 /etc/rc2.d/S904235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2 Process not Found /etc/rc2.d/S90�� /etc/rc2.d/S90�� Process not Found /etc/rc5.d/S90�� /etc/rc5.d/S90�� Process not Found /etc/rc3.d/S904235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2 /etc/rc3.d/S904235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2 Process not Found /etc/rc4.d/S90�� /etc/rc4.d/S90�� Process not Found /etc/rc0.d/ /etc/rc0.d/ update-rc.d /etc/rc4.d/ /etc/rc4.d/ update-rc.d /etc/rc3.d/ /etc/rc3.d/ update-rc.d /etc/rc1.d/S90�� /etc/rc1.d/S90�� Process not Found /etc/rc3.d/S90�� /etc/rc3.d/S90�� Process not Found /etc/rc4.d/S904235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2 /etc/rc4.d/S904235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2 Process not Found /etc/rc5.d/S904235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2 /etc/rc5.d/S904235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2 Process not Found /etc/rc5.d/ /etc/rc5.d/ update-rc.d /etc/rc2.d/ /etc/rc2.d/ update-rc.d /etc/rc6.d/ /etc/rc6.d/ update-rc.d /etc/rc1.d/ /etc/rc1.d/ update-rc.d -
Write file to user bin folder 1 TTPs 4 IoCs
description ioc Process /usr/bin/txeiymuiiz /usr/bin/txeiymuiiz Process not Found /usr/bin/rrrtuppcvx /usr/bin/rrrtuppcvx Process not Found /usr/bin/rkdinbtgyg /usr/bin/rkdinbtgyg Process not Found /usr/sbin/update-rc.d /usr/sbin/update-rc.d update-rc.d -
Reads runtime system information 7 IoCs
Reads data from /proc virtual filesystem.
description ioc Process /proc/self/stat /proc/self/stat systemctl /proc/sys/kernel/osrelease /proc/sys/kernel/osrelease systemctl /proc/1/environ /proc/1/environ systemctl /proc/1/sched /proc/1/sched systemctl /proc/cmdline /proc/cmdline systemctl /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems systemctl -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
description ioc /tmp/rkdinbtgyg /tmp/rkdinbtgyg /tmp/txeiymuiiz /tmp/txeiymuiiz /tmp/rrrtuppcvx /tmp/rrrtuppcvx
Processes
-
./4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2./4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d21⤵PID:571
-
/bin/shsh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"1⤵
- Creates/modifies Cron job
PID:577 -
/bin/sedsed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab2⤵
- Creates/modifies Cron job
- Reads runtime system information
PID:578
-
-
/bin/chkconfigchkconfig --add 4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d21⤵PID:574
-
/sbin/chkconfigchkconfig --add 4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d21⤵PID:574
-
/usr/bin/chkconfigchkconfig --add 4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d21⤵PID:574
-
/usr/sbin/chkconfigchkconfig --add 4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d21⤵PID:574
-
/usr/local/bin/chkconfigchkconfig --add 4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d21⤵PID:574
-
/usr/local/sbin/chkconfigchkconfig --add 4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d21⤵PID:574
-
/usr/X11R6/bin/chkconfigchkconfig --add 4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d21⤵PID:574
-
/bin/update-rc.dupdate-rc.d 4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2 defaults1⤵PID:576
-
/sbin/update-rc.dupdate-rc.d 4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2 defaults1⤵PID:576
-
/usr/bin/update-rc.dupdate-rc.d 4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2 defaults1⤵PID:576
-
/usr/sbin/update-rc.dupdate-rc.d 4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2 defaults1⤵
- Modifies rc script
- Write file to user bin folder
PID:576 -
/bin/systemctlsystemctl daemon-reload2⤵
- Reads runtime system information
PID:582
-
-
/usr/bin/txeiymuiiz/usr/bin/txeiymuiiz "grep \"A\"" 5721⤵PID:588
-
/usr/bin/txeiymuiiz/usr/bin/txeiymuiiz who 5721⤵PID:606
-
/usr/bin/txeiymuiiz/usr/bin/txeiymuiiz ls 5721⤵PID:609
-
/usr/bin/txeiymuiiz/usr/bin/txeiymuiiz whoami 5721⤵PID:612
-
/usr/bin/txeiymuiiz/usr/bin/txeiymuiiz top 5721⤵PID:615
-
/usr/bin/rrrtuppcvx/usr/bin/rrrtuppcvx "netstat -an" 5721⤵PID:618
-
/usr/bin/rrrtuppcvx/usr/bin/rrrtuppcvx pwd 5721⤵PID:621
-
/usr/bin/rrrtuppcvx/usr/bin/rrrtuppcvx who 5721⤵PID:624
-
/usr/bin/rrrtuppcvx/usr/bin/rrrtuppcvx ls 5721⤵PID:627
-
/usr/bin/rrrtuppcvx/usr/bin/rrrtuppcvx gnome-terminal 5721⤵PID:630
-
/usr/bin/rkdinbtgyg/usr/bin/rkdinbtgyg "ifconfig eth0" 5721⤵PID:633
-
/usr/bin/rkdinbtgyg/usr/bin/rkdinbtgyg su 5721⤵PID:636
-
/usr/bin/rkdinbtgyg/usr/bin/rkdinbtgyg whoami 5721⤵PID:639
-
/usr/bin/rkdinbtgyg/usr/bin/rkdinbtgyg "grep \"A\"" 5721⤵PID:642
-
/usr/bin/rkdinbtgyg/usr/bin/rkdinbtgyg whoami 5721⤵PID:645
-
/usr/bin/lklbklkfnk/usr/bin/lklbklkfnk ifconfig 5721⤵PID:648