Analysis
- max time kernel
0s - max time network
114s - platform
linux_amd64 - resource
ubuntu1804-amd64-en-20211208 - resource tags
- submitted
03/09/2022, 22:20
General
- Target 4f02cc4d5426b63e3eca3ada3c9a8a111a952c0e373c5500519ea8eea5ade853
- Size 549KB
- Sample220903-185rysgeb2
- SHA256 4f02cc4d5426b63e3eca3ada3c9a8a111a952c0e373c5500519ea8eea5ade853
Score
9/10
Malware Config
Signatures
- Writes file to system bin folder 1 TTPs 16 IoCs
- Modifies rc script 1 TTPs 5 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
- Writes file to shm directory 1 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/4f02cc4d5426b63e3eca3ada3c9a8a111a952c0e373c5500519ea8eea5ade853/tmp/4f02cc4d5426b63e3eca3ada3c9a8a111a952c0e373c5500519ea8eea5ade8531⤵
-
/bin/hovuqeq/bin/hovuqeq1⤵
-
/bin/eatnhwwileys/bin/eatnhwwileys -d 5761⤵
-
/bin/xouuqtccova/bin/xouuqtccova -d 5761⤵
-
/bin/eltlfimjfmmma/bin/eltlfimjfmmma -d 5761⤵
-
/bin/tglszjiwfypjb/bin/tglszjiwfypjb -d 5761⤵
-
/bin/edjjqcwvkkf/bin/edjjqcwvkkf -d 5761⤵
-
/bin/tdzoyfzrek/bin/tdzoyfzrek -d 5761⤵
-
/bin/cqctbdxi/bin/cqctbdxi -d 5761⤵
-
/bin/gtyipwuzdmy/bin/gtyipwuzdmy -d 5761⤵
-
/bin/pxkoclhjwilo/bin/pxkoclhjwilo -d 5761⤵
-
/bin/fppezzmsawjwq/bin/fppezzmsawjwq -d 5761⤵
-
/bin/zejxujjkn/bin/zejxujjkn -d 5761⤵
-
/bin/rwqbkg/bin/rwqbkg -d 5761⤵
-
/bin/ryfvxfj/bin/ryfvxfj -d 5761⤵
-
/bin/fhbdzoee/bin/fhbdzoee -d 5761⤵
-
/bin/byjkkwgb/bin/byjkkwgb -d 5761⤵
-
/bin/zeffuwdatdhexo/bin/zeffuwdatdhexo -d 5761⤵
-
/bin/arkpvop/bin/arkpvop -d 5761⤵