Overview

overview

10

Static

static

10

bitspin

ubuntu-18.04-amd64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bitspin

  • Size

    1KB

  • Sample

    220809-1r6mxsgghq

  • MD5

    6b13e69cc37757b1f2dbc2a1c8f806f1

  • SHA1

    01364dc40e5f1005fd7cd6e087368d64b35896f7

  • SHA256

    d318e9f2086c3cf2a258e275f9c63929b4560744a504ced68622b2e0b3f56374

  • SHA512

    c46a38378e024c06251f3aa61a35a2e31f2e6a17da1284d100d78de0708a1e0852b10da74d59ec888e374a3ed8c0533851e46410d0df48da901b151b086ffdab

Score
10/10
metasploitantivmlinuxpersistence

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Targets

    • Target

      bitspin

    • Size

      1KB

    • MD5

      6b13e69cc37757b1f2dbc2a1c8f806f1

    • SHA1

      01364dc40e5f1005fd7cd6e087368d64b35896f7

    • SHA256

      d318e9f2086c3cf2a258e275f9c63929b4560744a504ced68622b2e0b3f56374

    • SHA512

      c46a38378e024c06251f3aa61a35a2e31f2e6a17da1284d100d78de0708a1e0852b10da74d59ec888e374a3ed8c0533851e46410d0df48da901b151b086ffdab

    Score
    9/10
    antivmpersistence

    • Attempts to identify hypervisor via CPU configuration

      Checks CPU information for indicators that the system is a virtual machine.

      antivm

    • Modifies hosts file

      Adds to hosts file used for mapping hosts to IP addresses.

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence

    • Reads CPU attributes

    • Enumerates kernel/hardware configuration

      Reads contents of /sys virtual filesystem to enumerate system information.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    • Writes file to tmp directory

      Malware often drops required files in the /tmp directory.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Dynamic Resolution

1
T1568

Impact

Tasks