Analysis
-
max time kernel
0s -
max time network
153s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
13-08-2022 06:51
Behavioral task
behavioral1
Sample
6f3a8d9d70998f0d35bf98a1f4100cf5
Resource
ubuntu1804-amd64-en-20211208
1 signatures
150 seconds
General
-
Target
6f3a8d9d70998f0d35bf98a1f4100cf5
-
Size
56KB
-
MD5
6f3a8d9d70998f0d35bf98a1f4100cf5
-
SHA1
82f68967021942a9c3c83094a6cbc4306e6d2263
-
SHA256
51b969c23bd589abcb26a558800f14c2c7d1669e72efaf90744b7a8ff1918e28
-
SHA512
d6de061e134b9fb0da592c1d42604f70e3c6a6dbd79877d24c7ac51a76703efad516734e23dd8b5505200f87e59724d0564bed10a971c8acdd391117aba7c76a
Score
5/10
Malware Config
Signatures
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes:
mkdirmvdescription ioc process /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems mv
Processes
-
/tmp/6f3a8d9d70998f0d35bf98a1f4100cf5/tmp/6f3a8d9d70998f0d35bf98a1f4100cf51⤵
-
/bin/shsh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/6f3a8d9d70998f0d35bf98a1f4100cf5 bin/busybox; chmod 777 bin/busybox"1⤵
-
/bin/rmrm -rf bin/busybox2⤵
-
/bin/mkdirmkdir bin2⤵
- Reads runtime system information
-
/bin/mvmv /tmp/6f3a8d9d70998f0d35bf98a1f4100cf5 bin/busybox2⤵
- Reads runtime system information
-
/bin/chmodchmod 777 bin/busybox2⤵