Analysis
-
max time kernel
0s -
max time network
7s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
27-07-2022 06:37
Behavioral task
behavioral1
Sample
Linux.encryptor
Resource
ubuntu1804-amd64-en-20211208
6 signatures
150 seconds
General
-
Target
Linux.encryptor
-
Size
2.0MB
-
MD5
3f9a28e8c057e7ea7ccf15a4db81f362
-
SHA1
10d6d3c957facf06098771bf409b9593eea58c75
-
SHA256
6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502
-
SHA512
58a71aeac247d206f023ee29aff81026881e41d3fbd268f7513e3bcd951701a68502361dd717befa79a094eb9fc0caaa9f8770ba83f5c94a8acb9ae0986ee386
Score
9/10
Malware Config
Signatures
-
Deletes system logs 1 TTPs 6 IoCs
Processes:
description ioc /var/log/dist-upgrade /var/log/dist-upgrade /var/log/apt /var/log/apt /var/log/installer /var/log/installer /var/log/installer/cdebconf /var/log/installer/cdebconf /var/log/journal /var/log/journal /var/log/journal/40aaf6fa720047dbb97c78c09debbef3 /var/log/journal/40aaf6fa720047dbb97c78c09debbef3 -
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
Processes:
description ioc /etc/hosts /etc/hosts -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads CPU attributes 1 TTPs 1 IoCs
Processes:
description ioc /sys/devices/system/cpu/online /sys/devices/system/cpu/online -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes:
Linux.encryptordescription ioc /tmp/Linux.encryptor /tmp/Linux.encryptor /tmp/.DBFD055C-9CF2-4BB8-908E-6DA22321BF17 /tmp/.DBFD055C-9CF2-4BB8-908E-6DA22321BF17 Linux.encryptor /tmp/main.log /tmp/main.log