fd3c33e473a0c0ee996b863f99be3aec00e8e78958598e48cb4939c1260fda1e

Analysis

max time kernel
0s
max time network
154s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
15-08-2022 01:18

Target

skid.x86
Size

75KB
MD5

7a48eb95ce3922aed99add8f1e13aa25
SHA1

c625730c858c8cb1ced4e99edd2be4ca147d6eb6
SHA256

fd3c33e473a0c0ee996b863f99be3aec00e8e78958598e48cb4939c1260fda1e
SHA512

74fc4f80f5435a7fdf4c20b6c1cf0e45dd6830aff4f35869ad48ad4ae17379b36883217350e96254e1444d0fb62ff3410f1c9d70ed065fbbbd86caaecbbead86

Score

9^/10

discovery

Contacts a large (23514) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.

Processes:

mkdirmv

description ioc process

/proc/filesystems /proc/filesystems mkdir
/proc/filesystems /proc/filesystems mv

description	ioc	process
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	mv

/bin/sh
sh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/skid.x86 bin/busybox; chmod 777 bin/busybox"
1⤵
PID:572

/bin/mv
mv /tmp/skid.x86 bin/busybox
2⤵
- Reads runtime system information
PID:575

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact