4b95213d319a62985493ec0930d7742c0e892323e39e121204693099858ce791 | Triage

Analysis

max time kernel
0s
max time network
103s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28/09/2022, 13:48

Sharing

Report Analysis Logs

General

Target

bruteratel/adhoc_scripts/badgerNotifier.py
Size

4KB
MD5

206d540baa72f2df91f4c4b36bee984b
SHA1

f8e4a98bf0fbf2b8e9ddacf5fa39876af3bfd9eb
SHA256

115016a9a38aa9033fb814e57d839816566191099f3800eeaf9c2d2b584a4b2a
SHA512

7d2ed0538f7703320df3cdb16adb4d37590eae16ffa4aa74ecbd3b995d0749735df06248b92929a6cb19fefa1c574be97ce4740bcc270d5e569ff0bf49ccd8bd
SSDEEP

96:QtoSkpqZZfYad707qLn79sCL8e7ueGRaM9i:QtoH8ZfYaZ0sn79sCweLGRaM9i

Score

9^/10

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

description	ioc	Process
/sbin/ldconfig	/sbin/ldconfig	ldconfig

Write file to user bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

description	ioc	Process
/usr/bin/pyvenv.cfg	/usr/bin/pyvenv.cfg	badgerNotifier.py

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/self/fd	/proc/self/fd	Process not Found
/proc/self/status	/proc/self/status	badgerNotifier.py
/proc/mounts	/proc/mounts	badgerNotifier.py

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/bruteratel/adhoc_scripts/badgerNotifier.py	/tmp/bruteratel/adhoc_scripts/badgerNotifier.py	badgerNotifier.py
/tmp/bruteratel/adhoc_scripts	/tmp/bruteratel/adhoc_scripts	badgerNotifier.py

/tmp/bruteratel/adhoc_scripts/badgerNotifier.py
/tmp/bruteratel/adhoc_scripts/badgerNotifier.py
1⤵
- Write file to user bin folder
- Reads runtime system information
- Writes file to tmp directory
PID:593
- /sbin/ldconfig
  /sbin/ldconfig -p
  2⤵
  - Writes file to system bin folder
  PID:598
- /sbin/ldconfig.real
  /sbin/ldconfig.real -p
  2⤵
  PID:598
- /bin/sh
  /bin/sh -c "uname -p 2> /dev/null"
  2⤵
  PID:599
- - /bin/uname
    uname -p
    3⤵
    PID:600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads