Analysis
-
max time kernel
0s -
max time network
155s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
15-08-2022 18:19
Behavioral task
behavioral1
Sample
skid.x86_64-20220815-1818
Resource
ubuntu1804-amd64-en-20211208
3 signatures
150 seconds
General
-
Target
skid.x86_64-20220815-1818
-
Size
64KB
-
MD5
15dfa70bcba3131201a51a9b7617554c
-
SHA1
7bdd20801fdeb896ca31a85e0b022c5ab8dc3a69
-
SHA256
69c1e1a1c636a7384272d8841e9da38bd8decbb4b14965b7d9c8e3d66ebe8ba5
-
SHA512
e1f497568871fa8f4cb11daf23a9fa9f97f50ea705b745a7ff7ddeebb7da85744f01e097509850dc3cc7a866db64e4034b34e02132088f11d2e5e9a55c79be62
Score
9/10
Malware Config
Signatures
-
Contacts a large (23675) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes:
mkdirmvdescription ioc process /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems mv
Processes
-
/tmp/skid.x86_64-20220815-1818/tmp/skid.x86_64-20220815-18181⤵
-
/bin/shsh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/skid.x86_64-20220815-1818 bin/busybox; chmod 777 bin/busybox"1⤵
-
/bin/rmrm -rf bin/busybox2⤵
-
/bin/mkdirmkdir bin2⤵
- Reads runtime system information
-
/bin/mvmv /tmp/skid.x86_64-20220815-1818 bin/busybox2⤵
- Reads runtime system information
-
/bin/chmodchmod 777 bin/busybox2⤵