Analysis

  • max time kernel
    0s
  • max time network
    7s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    27-07-2022 06:37

General

  • Target

    Linux.encryptor

  • Size

    2.0MB

  • MD5

    3f9a28e8c057e7ea7ccf15a4db81f362

  • SHA1

    10d6d3c957facf06098771bf409b9593eea58c75

  • SHA256

    6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502

  • SHA512

    58a71aeac247d206f023ee29aff81026881e41d3fbd268f7513e3bcd951701a68502361dd717befa79a094eb9fc0caaa9f8770ba83f5c94a8acb9ae0986ee386

Score
9/10

Malware Config

Signatures

  • Deletes system logs 1 TTPs 6 IoCs
  • Modifies hosts file 1 IoCs

    Adds to hosts file used for mapping hosts to IP addresses.

  • Writes DNS configuration 1 TTPs 1 IoCs

    Writes data to DNS resolver config file.

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/Linux.encryptor
    /tmp/Linux.encryptor
    1⤵
    • Writes file to tmp directory
    PID:577

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads