bfa8d23103e43211013f1edc0a027be27e6ff349139772ee7a1353987059245b

Analysis

max time kernel
22027s
max time network
154s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20-08-2022 15:21

Target

skid.x86_64-20220820-1520
Size

72KB
MD5

7fa7e6efe6fb45748825bac13b2aebe2
SHA1

417aebce932a97f5e628143f205d926ec42134d2
SHA256

bfa8d23103e43211013f1edc0a027be27e6ff349139772ee7a1353987059245b
SHA512

ffe198b9cedb694b6f9be913186976701154e4dba1b9553a8ea519bd1a8bd2ff21be14ff83c13b8012cec09aa4ee85613218b824edce8779c503c9de619252a7

Score

9^/10

discovery

Contacts a large (23512) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.

Processes:

mkdirmv

description ioc process

/proc/filesystems /proc/filesystems mkdir
/proc/filesystems /proc/filesystems mv

description	ioc	process
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	mv

/bin/sh
sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/skid.x86_64-20220820-1520 bin/watchdog; chmod 777 bin/watchdog"
1⤵
PID:578

/bin/mv
mv /tmp/skid.x86_64-20220820-1520 bin/watchdog
2⤵
- Reads runtime system information
PID:581

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact