af14fcbcf9c5f8f68c25ee485a35ebd87f720009f080377cb4323324a728b83f

Analysis

max time kernel
0s
max time network
154s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
12-08-2022 23:01

Target

skid.x86
Size

53KB
MD5

357ae09836eec7a0d0992be3ab1368d7
SHA1

e43d4ff7bc11e6180c0fa2b1a73670e403238c78
SHA256

af14fcbcf9c5f8f68c25ee485a35ebd87f720009f080377cb4323324a728b83f
SHA512

9db6ad90ee3de194a4e3feab4db22f921ed88b07741204211efba5f47354dfe70412927496a7923a4514eb85d61f1d4f9ce0597c742156bdcce740ba76d05f7a

Score

9^/10

discovery

Contacts a large (23510) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.

Processes:

mkdirmv

description ioc process

/proc/filesystems /proc/filesystems mkdir
/proc/filesystems /proc/filesystems mv

description	ioc	process
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	mv

/bin/sh
sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/skid.x86 bin/watchdog; chmod 777 bin/watchdog"
1⤵
PID:581

/bin/mv
mv /tmp/skid.x86 bin/watchdog
2⤵
- Reads runtime system information
PID:584

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Exfiltration

Command and Control

Impact