af14fcbcf9c5f8f68c25ee485a35ebd87f720009f080377cb4323324a728b83f

Analysis

max time kernel
0s
max time network
154s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
12-08-2022 23:01

Target

skid.x86
Size

53KB
MD5

357ae09836eec7a0d0992be3ab1368d7
SHA1

e43d4ff7bc11e6180c0fa2b1a73670e403238c78
SHA256

af14fcbcf9c5f8f68c25ee485a35ebd87f720009f080377cb4323324a728b83f
SHA512

9db6ad90ee3de194a4e3feab4db22f921ed88b07741204211efba5f47354dfe70412927496a7923a4514eb85d61f1d4f9ce0597c742156bdcce740ba76d05f7a

Score

9^/10

discovery

Contacts a large (23510) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	mv

/bin/sh
sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/skid.x86 bin/watchdog; chmod 777 bin/watchdog"
1⤵
PID:581
- /bin/rm
  rm -rf bin/watchdog
  2⤵
  PID:582
- /bin/mkdir
  mkdir bin
  2⤵
  - Reads runtime system information
  PID:583
- /bin/mv
  mv /tmp/skid.x86 bin/watchdog
  2⤵
  - Reads runtime system information
  PID:584
- /bin/chmod
  chmod 777 bin/watchdog
  2⤵
  PID:585

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact