Analysis
-
max time kernel
0s -
max time network
30s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
07-11-2022 23:36
Behavioral task
behavioral1
Sample
aace5b50fd52bb363e455d55658139740e5eede1b93205a0256f122bf46f77bc
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
aace5b50fd52bb363e455d55658139740e5eede1b93205a0256f122bf46f77bc
-
Size
596KB
-
MD5
d182ba6ee51c8a03b588fae0a3a98b32
-
SHA1
97a69d150b3354d863e934b3b65272a1d813983a
-
SHA256
aace5b50fd52bb363e455d55658139740e5eede1b93205a0256f122bf46f77bc
-
SHA512
36e0b75fea7964daf77e4dc76b06b8e600e890cd25721e5367e7e6406f0d4430f7ebe1cc0e3886462f063feebbb4dc85d542821abab4763e030df25ba07d44da
-
SSDEEP
12288:rPTJS+naeW9kclFEcMWbHdxZ7GkR2fh/6y9P/YAh7Dxu9hc73:DTJfrW99q4bHdxZ7G1fhFND4Xcz
Malware Config
Signatures
-
Writes file to system bin folder 1 TTPs 3 IoCs
Processes:
description ioc /bin/zqqwxmpril /bin/zqqwxmpril /bin/oefvqgwrol /bin/oefvqgwrol /bin/krbkosumbn /bin/krbkosumbn -
Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
sedshdescription ioc Process /etc/crontab /etc/crontab sed /etc/crontab /etc/crontab sh -
Modifies rc script 1 TTPs 12 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
Processes:
update-rc.ddescription ioc Process /etc/rc1.d/S90aace5b50fd52bb363e455d55658139740e5eede1b93205a0256f122bf46f77bc /etc/rc1.d/S90aace5b50fd52bb363e455d55658139740e5eede1b93205a0256f122bf46f77bc