Overview

overview

9

Static

static

p.x86_64-64.so

ubuntu-18.04-amd64

9

Analysis

  • max time kernel
    0s
  • max time network
    167s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    08-08-2022 06:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    p.x86_64-64.so

  • Size

    3.5MB

  • MD5

    0634a1c2c473bcf909e780304e9ba353

  • SHA1

    ee38c52c6335136cf8270449e770415fe2f46757

  • SHA256

    920375ffb3d7cb9195776f4d3b375112c45188f069c7632ef5090702b7fc3c3c

  • SHA512

    a8092b8e1e358a820ec85dc0d7bbc92768121be03630570ae5c67b0b88cdc19827c2e3ab2130878ca35836d9146fa1e7ed5684a0bba49b5c9a5227a1ef0db06e

Score
9/10
backdoor

Malware Config

Signatures

  • Writes file to system bin folder 1 TTPs 1 IoCs
  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads network interface configuration 2 TTPs 6 IoCs

    Fetches information about one or more active network interfaces.

    backdoor
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 16 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/p.x86_64-64.so
    /tmp/p.x86_64-64.so
    1⤵
      PID:581
    • /sbin/ldconfig
      /sbin/ldconfig -p
      1⤵
      • Writes file to system bin folder
      PID:587
    • /sbin/ldconfig.real
      /sbin/ldconfig.real -p
      1⤵
        PID:587

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Hijack Execution Flow

      1
      T1574

      Privilege Escalation

      Hijack Execution Flow

      1
      T1574

      Defense Evasion

      Hijack Execution Flow

      1
      T1574

      Credential Access

      Discovery

      System Information Discovery

      2
      T1082

      System Network Configuration Discovery

      1
      T1016

      System Network Connections Discovery

      1
      T1049

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads