Resubmissions
11/11/2022, 05:27
221111-f5mfzsbddr1011/11/2022, 05:26
221111-f418rabddp1011/11/2022, 05:23
221111-f3encsbddl1011/11/2022, 01:46
221111-b665kaabar1011/11/2022, 01:45
221111-b6klkagag51011/11/2022, 01:45
221111-b6cwqagag31011/11/2022, 01:43
221111-b5fwzsaahq10Analysis
- max time kernel
0s - max time network
209s - platform
linux_amd64 - resource
ubuntu1804-amd64-en-20211208 - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
11/11/2022, 01:46
Behavioral task
behavioral1
Sample
3a08e3bfec2db5dbece359ac9662e65361a8625a0122e68b56cd5ef3aedf8ce1
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
6 signatures
150 seconds
General
- Target 3a08e3bfec2db5dbece359ac9662e65361a8625a0122e68b56cd5ef3aedf8ce1
- Size 1.8MB
- Sample221111-b665kaabar
- SHA256 3a08e3bfec2db5dbece359ac9662e65361a8625a0122e68b56cd5ef3aedf8ce1
- MD5 92ed8739cfb9132c8b57016e3c071a28
- SHA1 362aa21546904629b28a56c9d5c4bfd3b53296f5
- SHA512 755cab9f92d9bb39b1afc890e6d220f1e9ff884bb5c9ab9a526dd7af204fa88c21d88fb2c153c28eb577a5730548dca3ad8ffa20d3b31ed3fb550fce98f7c3d3
- SSDEEP 49152:IqeL+lTdKGwpizjdRVdjezCFvw9b28vXUG3ao3tGbK:Iqe0/FdjezChlbK
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Deletes system logs 1 TTPs 64 IoCs
description ioc /var/log/checkpoints-lastlog.nnvjxgy /var/log/checkpoints-lastlog.nnvjxgy /var/log/wtmp.nnvjxgy /var/log/wtmp.nnvjxgy /var/log/checkpoints-syslog.nnvjxgy /var/log/checkpoints-syslog.nnvjxgy /var/log/installer/cdebconf/templates.dat.nnvjxgy /var/log/installer/cdebconf/templates.dat.nnvjxgy /var/log/journal/40aaf6fa720047dbb97c78c09debbef3/system.journal.nnvjxgy /var/log/journal/40aaf6fa720047dbb97c78c09debbef3/system.journal.nnvjxgy /var/log/RECOVER-nnvjxgy-FILES.txt /var/log/RECOVER-nnvjxgy-FILES.txt /var/log/checkpoints-wtmp.nnvjxgy /var/log/checkpoints-wtmp.nnvjxgy /var/log/dpkg.log.nnvjxgy /var/log/dpkg.log.nnvjxgy /var/log/installer/hardware-summary /var/log/installer/hardware-summary /var/log/installer/RECOVER-nnvjxgy-FILES.txt /var/log/installer/RECOVER-nnvjxgy-FILES.txt /var/log/checkpoints-alternatives.log.nnvjxgy /var/log/checkpoints-alternatives.log.nnvjxgy /var/log/journal/40aaf6fa720047dbb97c78c09debbef3 /var/log/journal/40aaf6fa720047dbb97c78c09debbef3 /var/log/installer/partman /var/log/installer/partman /var/log/installer/cdebconf/RECOVER-nnvjxgy-FILES.txt /var/log/installer/cdebconf/RECOVER-nnvjxgy-FILES.txt /var/log/installer/cdebconf/questions.dat.nnvjxgy /var/log/installer/cdebconf/questions.dat.nnvjxgy /var/log/checkpoints-kern.log.nnvjxgy /var/log/checkpoints-kern.log.nnvjxgy /var/log/checkpoints-dpkg.log.nnvjxgy /var/log/checkpoints-dpkg.log.nnvjxgy /var/log/apt/checkpoints-term.log.nnvjxgy /var/log/apt/checkpoints-term.log.nnvjxgy /var/log/apt/checkpoints-eipp.log.xz.nnvjxgy /var/log/apt/checkpoints-eipp.log.xz.nnvjxgy /var/log/journal /var/log/journal /var/log/journal/40aaf6fa720047dbb97c78c09debbef3/checkpoints-system.journal.nnvjxgy /var/log/journal/40aaf6fa720047dbb97c78c09debbef3/checkpoints-system.journal.nnvjxgy /var/log/faillog /var/log/faillog /var/log/faillog.nnvjxgy /var/log/faillog.nnvjxgy /var/log/dist-upgrade /var/log/dist-upgrade /var/log/installer/checkpoints-partman.nnvjxgy /var/log/installer/checkpoints-partman.nnvjxgy /var/log/installer/cdebconf/questions.dat /var/log/installer/cdebconf/questions.dat /var/log/installer/cdebconf/checkpoints-questions.dat.nnvjxgy /var/log/installer/cdebconf/checkpoints-questions.dat.nnvjxgy /var/log/checkpoints-faillog.nnvjxgy /var/log/checkpoints-faillog.nnvjxgy /var/log/apt/history.log /var/log/apt/history.log /var/log/apt/eipp.log.xz /var/log/apt/eipp.log.xz /var/log/installer/initial-status.gz.nnvjxgy /var/log/installer/initial-status.gz.nnvjxgy /var/log/installer/cdebconf /var/log/installer/cdebconf /var/log/btmp /var/log/btmp /var/log/syslog /var/log/syslog /var/log/apt/term.log.nnvjxgy /var/log/apt/term.log.nnvjxgy /var/log/installer/lsb-release /var/log/installer/lsb-release /var/log/installer/status /var/log/installer/status /var/log/lastlog.nnvjxgy /var/log/lastlog.nnvjxgy /var/log/apt/checkpoints-history.log.nnvjxgy /var/log/apt/checkpoints-history.log.nnvjxgy /var/log/installer/syslog /var/log/installer/syslog /var/log/installer/partman.nnvjxgy /var/log/installer/partman.nnvjxgy /var/log/journal/40aaf6fa720047dbb97c78c09debbef3/system.journal /var/log/journal/40aaf6fa720047dbb97c78c09debbef3/system.journal /var/log/journal/40aaf6fa720047dbb97c78c09debbef3/RECOVER-nnvjxgy-FILES.txt /var/log/journal/40aaf6fa720047dbb97c78c09debbef3/RECOVER-nnvjxgy-FILES.txt /var/log/tallylog.nnvjxgy /var/log/tallylog.nnvjxgy /var/log/checkpoints-tallylog.nnvjxgy /var/log/checkpoints-tallylog.nnvjxgy /var/log/apt/history.log.nnvjxgy /var/log/apt/history.log.nnvjxgy /var/log/installer/cdebconf/templates.dat /var/log/installer/cdebconf/templates.dat /var/log/installer/cdebconf/checkpoints-templates.dat.nnvjxgy /var/log/installer/cdebconf/checkpoints-templates.dat.nnvjxgy /var/log/kern.log.nnvjxgy /var/log/kern.log.nnvjxgy /var/log/alternatives.log /var/log/alternatives.log /var/log/installer/syslog.nnvjxgy /var/log/installer/syslog.nnvjxgy /var/log/kern.log /var/log/kern.log /var/log/installer/checkpoints-hardware-summary.nnvjxgy /var/log/installer/checkpoints-hardware-summary.nnvjxgy /var/log/installer/lsb-release.nnvjxgy /var/log/installer/lsb-release.nnvjxgy /var/log/installer/status.nnvjxgy /var/log/installer/status.nnvjxgy /var/log/auth.log /var/log/auth.log /var/log/lastlog /var/log/lastlog /var/log/dpkg.log /var/log/dpkg.log /var/log/apt /var/log/apt /var/log/installer/hardware-summary.nnvjxgy /var/log/installer/hardware-summary.nnvjxgy /var/log/tallylog /var/log/tallylog /var/log/alternatives.log.nnvjxgy /var/log/alternatives.log.nnvjxgy /var/log/ubuntu-advantage.log /var/log/ubuntu-advantage.log /var/log/installer/initial-status.gz /var/log/installer/initial-status.gz - Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc /var/spool/cron/crontabs /var/spool/cron/crontabs - Modifies Bash startup script 1 TTPs 2 IoCs
description ioc /home/user/.bashrc /home/user/.bashrc /home/user/.profile /home/user/.profile - Reads CPU attributes 1 TTPs 1 IoCs
description ioc /sys/devices/system/cpu/online /sys/devices/system/cpu/online - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us 3a08e3bfec2db5dbece359ac9662e65361a8625a0122e68b56cd5ef3aedf8ce1 - Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.
description ioc Process /proc/self/maps /proc/self/maps 3a08e3bfec2db5dbece359ac9662e65361a8625a0122e68b56cd5ef3aedf8ce1 /proc/self/cgroup /proc/self/cgroup 3a08e3bfec2db5dbece359ac9662e65361a8625a0122e68b56cd5ef3aedf8ce1 /proc/self/mountinfo /proc/self/mountinfo 3a08e3bfec2db5dbece359ac9662e65361a8625a0122e68b56cd5ef3aedf8ce1