f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506

General

Target

f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506
Size

603B
MD5

cd00bcf841a3eede649d5a1797a03f5c
SHA1

c35f0a6d69f6bfaa044260ed939eef4a93ff7374
SHA256

f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506
SHA512

2a66497bfd183b004f023b46587d930da375147ff5cc6edad3ce26c2584204798d10fa5edc25c0b246978a795c84c8998b0f50ec01d89f8682b400ae7e371706

Score

5^/10

persistence

Malware Config

Signatures

Creates .desktop file 1 TTPs 1 IoCs
Linux desktops like GNOME require .desktop files to register applications. Sometimes abused by malware for persistence.
persistence

User Execution
T1204

Processes:

rm

description ioc process

/sys/dev/block/254:1/vim.desktop /sys/dev/block/254:1/vim.desktop rm

description	ioc	process
/sys/dev/block/254:1/vim.desktop	/sys/dev/block/254:1/vim.desktop	rm

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

rm

Reads runtime system information 5 IoCs

Reads data from /proc virtual filesystem.

Processes:

mountfdiskmkdirmkfs.ext2

description	ioc	process
/proc/filesystems	/proc/filesystems	mount
/proc/partitions	/proc/partitions	fdisk
/proc/filesystems	/proc/filesystems	mkdir
/proc/swaps	/proc/swaps	mkfs.ext2
/proc/mounts	/proc/mounts	mkfs.ext2

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

Processes:

f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506

description	ioc	process
/tmp/f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506	/tmp/f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506	f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506

/tmp/f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506
/tmp/f8cc042317dc129ac5ea4b675139c9d3abf3f4670903b17fe6c5c65b82f1c506
1⤵
- Writes file to tmp directory
PID:355

/sbin/fdisk
fdisk /dev/vda
2⤵
PID:364

/bin/rm
rm -rf hd
2⤵
PID:366

/sbin/mkfs.ext2
mkfs.ext2 /dev/vda1
2⤵
- Reads runtime system information
PID:365

/bin/mkdir
mkdir hd
2⤵
- Reads runtime system information
PID:367

/bin/mount
mount /dev/vda1 hd
2⤵
- Reads runtime system information
PID:369

/bin/rm
rm -rf hd/bin hd/boot hd/dev hd/etc hd/home hd/lib hd/lost+found hd/media hd/mnt hd/opt hd/proc hd/root hd/run hd/sbin hd/srv hd/sys hd/tmp hd/usr hd/var
2⤵
- Creates .desktop file
- Enumerates kernel/hardware configuration
PID:372

/bin/mkdir
mkdir hd/boot hd/boot/grub
2⤵
PID:384

/sbin/fdisk
fdisk -l
1⤵
- Reads runtime system information
PID:357

/bin/grep
grep -m 1 Disk
1⤵
PID:358

/usr/bin/awk
awk -F: "{print \$1}"
1⤵
PID:360

/usr/bin/awk
awk "{print \$2}"
1⤵
PID:359

MITRE ATT&CK Enterprise v6

Initial Access

Execution

User Execution

1

T1204

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

description	ioc	process
/sys/dev/block/254:1/start/Uni2-TerminusBoldVGA14.psf.gz	/sys/dev/block/254:1/start/Uni2-TerminusBoldVGA14.psf.gz	rm
/sys/dev/block/254:1/start/fsck.cramfs	/sys/dev/block/254:1/start/fsck.cramfs	rm
/sys/dev/block/254:1/exynos4412-odroidx2.dtb	/sys/dev/block/254:1/exynos4412-odroidx2.dtb	rm
/sys/dev/block/254:1/start/kinit.shared	/sys/dev/block/254:1/start/kinit.shared	rm
/sys/dev/block/254:1/start/nvram.h	/sys/dev/block/254:1/start/nvram.h	rm
/sys/dev/block/254:1/start/lib.h	/sys/dev/block/254:1/start/lib.h	rm
/sys/dev/iio	/sys/dev/iio	rm
/sys/dev/key.h	/sys/dev/key.h	rm
/sys/dev/block/254:1/i2c-isch.ko	/sys/dev/block/254:1/i2c-isch.ko	rm
/sys/dev/block/254:1/start/coresight-stm.h	/sys/dev/block/254:1/start/coresight-stm.h	rm
/sys/dev/block/254:1/xattr.h	/sys/dev/block/254:1/xattr.h	rm
/sys/dev/block/254:1/wm8850.h	/sys/dev/block/254:1/wm8850.h	rm
/sys/dev/i2c-mux.h	/sys/dev/i2c-mux.h	rm
/sys/dev/block/254:1/start/endservent.3.gz	/sys/dev/block/254:1/start/endservent.3.gz	rm
/sys/dev/block/254:1/start/fflush_unlocked.3.gz	/sys/dev/block/254:1/start/fflush_unlocked.3.gz	rm
/sys/dev/block/254:1/start/ansi+rep	/sys/dev/block/254:1/start/ansi+rep	rm
/sys/dev/block/254:1/ppp_synctty.ko	/sys/dev/block/254:1/ppp_synctty.ko	rm
/sys/dev/block/254:1/asix.ko	/sys/dev/block/254:1/asix.ko	rm
/sys/dev/block/254:1/mtd_probe	/sys/dev/block/254:1/mtd_probe	rm
/sys/dev/block/ima	/sys/dev/block/ima	rm
/sys/dev/block/254:1/start/hop.h	/sys/dev/block/254:1/start/hop.h	rm
/sys/dev/block/254:1/llc.h	/sys/dev/block/254:1/llc.h	rm
/sys/dev/block/254:1/start/altos-3	/sys/dev/block/254:1/start/altos-3	rm
/sys/dev/block/254:1/start/pread.2.gz	/sys/dev/block/254:1/start/pread.2.gz	rm
/sys/dev/block/254:1/start/ftm.7.gz	/sys/dev/block/254:1/start/ftm.7.gz	rm
/sys/dev/block/254:1/XHTML.pm	/sys/dev/block/254:1/XHTML.pm	rm
/sys/dev/block/254:1/start/Hash	/sys/dev/block/254:1/start/Hash	rm
/sys/dev/block/254:1/dhclient-exit-hooks.d	/sys/dev/block/254:1/dhclient-exit-hooks.d	rm
/sys/dev/block/254:1/twl4030-madc.ko	/sys/dev/block/254:1/twl4030-madc.ko	rm
/sys/dev/block/254:1/hid-microsoft.ko	/sys/dev/block/254:1/hid-microsoft.ko	rm
/sys/dev/block/254:1/start/mqueue.h	/sys/dev/block/254:1/start/mqueue.h	rm
/sys/dev/block/254:1/cal	/sys/dev/block/254:1/cal	rm
/sys/dev/block/254:1/start/rcp.1.gz	/sys/dev/block/254:1/start/rcp.1.gz	rm
/sys/dev/block/254:1/con.h	/sys/dev/block/254:1/con.h	rm
/sys/dev/block/254:1/start/rdc.h	/sys/dev/block/254:1/start/rdc.h	rm
/sys/dev/block/254:1/ffs.h	/sys/dev/block/254:1/ffs.h	rm
/sys/dev/sha256_base.h	/sys/dev/sha256_base.h	rm
/sys/dev/block/254:1/g760a.ko	/sys/dev/block/254:1/g760a.ko	rm
/sys/dev/block/254:1/start/virtio_balloon.h	/sys/dev/block/254:1/start/virtio_balloon.h	rm
/sys/dev/block/254:1/oss	/sys/dev/block/254:1/oss	rm
/sys/dev/block/254:1/start/version.pm	/sys/dev/block/254:1/start/version.pm	rm
/sys/dev/block/254:1/ec100.h	/sys/dev/block/254:1/ec100.h	rm
/sys/dev/block/254:1/start/write.2.gz	/sys/dev/block/254:1/start/write.2.gz	rm
/sys/dev/block/254:1/start/dup2.2.gz	/sys/dev/block/254:1/start/dup2.2.gz	rm
/sys/dev/block/254:1/start/col.1.gz	/sys/dev/block/254:1/start/col.1.gz	rm
/sys/dev/block/254:1/start/ncr260vt200wpp	/sys/dev/block/254:1/start/ncr260vt200wpp	rm
/sys/dev/block/254:1/start/pt200w	/sys/dev/block/254:1/start/pt200w	rm
/sys/dev/block/254:1/start/DEC-MCS.so	/sys/dev/block/254:1/start/DEC-MCS.so	rm
/sys/dev/block/254:1/imx6dl-aristainetos_7.dtb	/sys/dev/block/254:1/imx6dl-aristainetos_7.dtb	rm
/sys/dev/block/254:1/errno.h	/sys/dev/block/254:1/errno.h	rm
/sys/dev/block/gpio	/sys/dev/block/gpio	rm
/sys/dev/block/254:1/start/863.h	/sys/dev/block/254:1/start/863.h	rm
/sys/dev/block/254:1/start/vte-256color	/sys/dev/block/254:1/start/vte-256color	rm
/sys/dev/block/254:1/builtin-__fls.h	/sys/dev/block/254:1/builtin-__fls.h	rm
/sys/dev/block/254:1/start/tvi912b+vb	/sys/dev/block/254:1/start/tvi912b+vb	rm
/sys/dev/block/254:1/start/ibm+color	/sys/dev/block/254:1/start/ibm+color	rm
/sys/dev/block/254:1/libksba.so.8	/sys/dev/block/254:1/libksba.so.8	rm
/sys/dev/block/254:1/start/omap	/sys/dev/block/254:1/start/omap	rm
/sys/dev/block/254:1/start/cyclades.h	/sys/dev/block/254:1/start/cyclades.h	rm
/sys/dev/block/254:1/tda7432.h	/sys/dev/block/254:1/tda7432.h	rm
/sys/dev/block/254:1/start/copy.h	/sys/dev/block/254:1/start/copy.h	rm
/sys/dev/block/254:1/omap3-devkit8000-lcd43.dtb	/sys/dev/block/254:1/omap3-devkit8000-lcd43.dtb	rm
/sys/dev/block/254:1/vigr	/sys/dev/block/254:1/vigr	rm
/sys/dev/block/254:1/start/dp	/sys/dev/block/254:1/start/dp	rm

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads