Analysis
-
max time kernel
0s -
max time network
155s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
19-08-2022 16:57
Behavioral task
behavioral1
Sample
skid.x86_64-20220819-1656
Resource
ubuntu1804-amd64-en-20211208
3 signatures
150 seconds
General
-
Target
skid.x86_64-20220819-1656
-
Size
65KB
-
MD5
d19fce988588e38cde58a67fe2d9fee5
-
SHA1
34c7115256aca9bd5d0376371be2882bd0271ad8
-
SHA256
ba254f2d2dec950d27652da7a9fa7bc27abd12682fb69c79f87592020f32e046
-
SHA512
4eeffedded8b375d9e0712971e9cb07027a2739d1efcf2cf274a888518056e1e99ef22c3048bf67e026c29377bc1ba2d9af3315c811357f332cd3e2ddb2bb27a
Score
9/10
Malware Config
Signatures
-
Contacts a large (23675) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes:
mvmkdirdescription ioc process /proc/filesystems /proc/filesystems mv /proc/filesystems /proc/filesystems mkdir
Processes
-
/tmp/skid.x86_64-20220819-1656/tmp/skid.x86_64-20220819-16561⤵
-
/bin/shsh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/skid.x86_64-20220819-1656 bin/busybox; chmod 777 bin/busybox"1⤵
-
/bin/rmrm -rf bin/busybox2⤵
-
/bin/mkdirmkdir bin2⤵
- Reads runtime system information
-
/bin/mvmv /tmp/skid.x86_64-20220819-1656 bin/busybox2⤵
- Reads runtime system information
-
/bin/chmodchmod 777 bin/busybox2⤵