796d3e0ecf84e22536967c7b4c8a6184800440090b9e9e6f31a863a88f7f4b93

Analysis

max time kernel
0s
max time network
134s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
25-11-2022 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

796d3e0ecf84e22536967c7b4c8a6184800440090b9e9e6f31a863a88f7f4b93
Size

1KB
MD5

f1149660b4530c0b5cd07dd50e068729
SHA1

ebac14614dc0e378a41001247ab6dbce9ca8209a
SHA256

796d3e0ecf84e22536967c7b4c8a6184800440090b9e9e6f31a863a88f7f4b93
SHA512

c0f42b1d747e789669edbfdbff4dc9fc145625b0e7904f3e169fbf79cf05154e2f4930fdfef563d5f62c5ba400d920752b6ab0b6c2a837db5e2dc4696f5b81a9

Score

7^/10

persistence

Malware Config

Signatures

Creates/modifies environment variables 1 TTPs 1 IoCs
Creating/modifying environment variables is a common persistence mechanism.
persistence

Hijack Execution Flow
T1574

Processes:

796d3e0ecf84e22536967c7b4c8a6184800440090b9e9e6f31a863a88f7f4b93

description ioc process

~/.bash_profile ~/.bash_profile 796d3e0ecf84e22536967c7b4c8a6184800440090b9e9e6f31a863a88f7f4b93

description	ioc	process
~/.bash_profile	~/.bash_profile	796d3e0ecf84e22536967c7b4c8a6184800440090b9e9e6f31a863a88f7f4b93

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

Processes:

796d3e0ecf84e22536967c7b4c8a6184800440090b9e9e6f31a863a88f7f4b93

description	ioc	process
/tmp/796d3e0ecf84e22536967c7b4c8a6184800440090b9e9e6f31a863a88f7f4b93	/tmp/796d3e0ecf84e22536967c7b4c8a6184800440090b9e9e6f31a863a88f7f4b93	796d3e0ecf84e22536967c7b4c8a6184800440090b9e9e6f31a863a88f7f4b93

/tmp/796d3e0ecf84e22536967c7b4c8a6184800440090b9e9e6f31a863a88f7f4b93
/tmp/796d3e0ecf84e22536967c7b4c8a6184800440090b9e9e6f31a863a88f7f4b93
1⤵
- Creates/modifies environment variables
- Writes file to tmp directory
PID:605

/bin/grep
grep "^default"
1⤵
PID:608

/usr/bin/awk
awk "{print \$2}"
1⤵
PID:609

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads