Analysis
-
max time kernel
19780s -
max time network
127s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
24-07-2022 05:23
Behavioral task
behavioral1
Sample
591895fe233e81599250a02d2418493ce9c249ad03be31dd38ba6b880a30c2dc
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
5 signatures
150 seconds
General
-
Target
591895fe233e81599250a02d2418493ce9c249ad03be31dd38ba6b880a30c2dc
-
Size
647KB
-
MD5
f8f82cf76d78be5823b27bf92c794b80
-
SHA1
5b3391ea0dfd9f6b4b3c58bbb2a5065d5e5beaef
-
SHA256
591895fe233e81599250a02d2418493ce9c249ad03be31dd38ba6b880a30c2dc
-
SHA512
3941f3cb3eb45812b2d466264ad7c6db2f2035a005e37698182135c54af6207e06a36bbe7ed6935f4c523b646c04d21f751a0988f1d9e48b9ea59dd8576747e8
Score
7/10
Malware Config
Signatures
-
Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
shseddescription ioc Process /etc/crontab /etc/crontab sh /etc/crontab /etc/crontab sed -
Modifies rc script 1 TTPs 12 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
Processes:
update-rc.ddescription ioc Process /etc/rc4.d/S90rmewwkvsky /etc/rc4.d/S90rmewwkvsky