cf79606eae2e092774cd526aab8792b57ad36b6ab85cd7522cf04f57289b8dea

Analysis

max time kernel
30454s
max time network
103s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
25-11-2022 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf79606eae2e092774cd526aab8792b57ad36b6ab85cd7522cf04f57289b8dea
Size

1KB
MD5

3b2586fd81c0ca699acfa342ca7e248f
SHA1

25d0f7abafe4e229c1aeaed0137988628263f63d
SHA256

cf79606eae2e092774cd526aab8792b57ad36b6ab85cd7522cf04f57289b8dea
SHA512

eb969364b7b884a2038180d2b6511db1eca0abff69147f63750347d3b9dc0ec37689939927f398e86acdb74e630fe7a071462e739cc502d8e26b2b3f3c37086d

Score

6^/10

Malware Config

Signatures

Reads CPU attributes 1 TTPs 3 IoCs

System Information Discovery

T1082

Processes:

pspsps

description	ioc	process
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pspskillallpskillallkillall

description	ioc	process
/proc/250/task	/proc/250/task	ps
/proc/593/task/593/status	/proc/593/task/593/status	ps
/proc/172/stat	/proc/172/stat	killall
/proc/7/task	/proc/7/task	ps
/proc/89/cmdline	/proc/89/cmdline	ps
/proc/250/cmdline	/proc/250/cmdline	killall
/proc/36/task/36/status	/proc/36/task/36/status	ps
/proc/1/task/1/cmdline	/proc/1/task/1/cmdline	ps
/proc/6/task/6/stat	/proc/6/task/6/stat	ps
/proc/21/stat	/proc/21/stat	ps
/proc/250/task/250/cmdline	/proc/250/task/250/cmdline	ps
/proc/34/cmdline	/proc/34/cmdline	ps
/proc/178/task/178/stat	/proc/178/task/178/stat	ps
/proc/422/stat	/proc/422/stat	ps
/proc/382/task/382/stat	/proc/382/task/382/stat	ps
/proc/79/stat	/proc/79/stat	killall
/proc/172/task/172/status	/proc/172/task/172/status	ps
/proc/13/stat	/proc/13/stat	ps
/proc/20/task/20/cmdline	/proc/20/task/20/cmdline	ps
/proc/98/task/98/stat	/proc/98/task/98/stat	ps
/proc/163/status	/proc/163/status	ps
/proc/366/task	/proc/366/task	ps
/proc/19/status	/proc/19/status	ps
/proc/9/stat	/proc/9/stat	ps
/proc/409/stat	/proc/409/stat	ps
/proc/591/stat	/proc/591/stat	ps
/proc/169/task/169/status	/proc/169/task/169/status	ps
/proc/89/stat	/proc/89/stat	ps
/proc/358/task/370/stat	/proc/358/task/370/stat	ps
/proc/605/task/609/stat	/proc/605/task/609/stat	ps
/proc/2/task/2/stat	/proc/2/task/2/stat	ps
/proc/166/task/166/cmdline	/proc/166/task/166/cmdline	ps
/proc/596/task/596/status	/proc/596/task/596/status	ps
/proc/9/cmdline	/proc/9/cmdline	ps
/proc/605/cmdline	/proc/605/cmdline	ps
/proc/173/task	/proc/173/task	ps
/proc/177/task	/proc/177/task	ps
/proc/178/status	/proc/178/status	ps
/proc/23/stat	/proc/23/stat	ps
/proc/422/cmdline	/proc/422/cmdline	ps
/proc/27/task/27/cmdline	/proc/27/task/27/cmdline	ps
/proc/165/status	/proc/165/status	ps
/proc/10/stat	/proc/10/stat	killall
/proc/171/task/171/stat	/proc/171/task/171/stat	ps
/proc/613/task/613/status	/proc/613/task/613/status	ps
/proc/14/task/14/cmdline	/proc/14/task/14/cmdline	ps
/proc/177/task/177/cmdline	/proc/177/task/177/cmdline	ps
/proc/424/task/424/stat	/proc/424/task/424/stat	ps
/proc/16/status	/proc/16/status	ps
/proc/165/task/165/cmdline	/proc/165/task/165/cmdline	ps
/proc/18/task/18/status	/proc/18/task/18/status	ps
/proc/173/task/173/stat	/proc/173/task/173/stat	ps
/proc/409/task	/proc/409/task	ps
/proc/591/stat	/proc/591/stat	ps
/proc/5/task/5/status	/proc/5/task/5/status	ps
/proc/389/task/389/stat	/proc/389/task/389/stat	ps
/proc/85/stat	/proc/85/stat	ps
/proc/605/task/608/stat	/proc/605/task/608/stat	ps
/proc/20/task/20/status	/proc/20/task/20/status	ps
/proc/78/cmdline	/proc/78/cmdline	ps
/proc/20/task/20/status	/proc/20/task/20/status	ps
/proc/180/task/180/status	/proc/180/task/180/status	ps
/proc/25/stat	/proc/25/stat	killall
/proc/35/stat	/proc/35/stat	killall

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

Processes:

cf79606eae2e092774cd526aab8792b57ad36b6ab85cd7522cf04f57289b8dea

description	ioc	process
/tmp/cf79606eae2e092774cd526aab8792b57ad36b6ab85cd7522cf04f57289b8dea	/tmp/cf79606eae2e092774cd526aab8792b57ad36b6ab85cd7522cf04f57289b8dea	cf79606eae2e092774cd526aab8792b57ad36b6ab85cd7522cf04f57289b8dea

/tmp/cf79606eae2e092774cd526aab8792b57ad36b6ab85cd7522cf04f57289b8dea
/tmp/cf79606eae2e092774cd526aab8792b57ad36b6ab85cd7522cf04f57289b8dea
1⤵
- Writes file to tmp directory
PID:593

/bin/date
date
2⤵
PID:594

/usr/bin/expr
expr 0
2⤵
PID:601

/usr/bin/killall
/usr/bin/killall -9 xDown.sh
2⤵
- Reads runtime system information
PID:602

/apps/www/htdocs/nm/xDown.sh
/apps/www/htdocs/nm/xDown.sh
2⤵
PID:603

/bin/sleep
sleep 60
2⤵
PID:604

/bin/date
date
2⤵
PID:610

/usr/bin/expr
expr 0
2⤵
PID:617

/usr/bin/killall
/usr/bin/killall -9 xDown.sh
2⤵
- Reads runtime system information
PID:618

/apps/www/htdocs/nm/xDown.sh
/apps/www/htdocs/nm/xDown.sh
2⤵
PID:619

/bin/sleep
sleep 60
2⤵
PID:620

/bin/date
date
2⤵
PID:736

/usr/bin/expr
expr 0
2⤵
PID:743

/usr/bin/killall
/usr/bin/killall -9 xDown.sh
2⤵
- Reads runtime system information
PID:744

/apps/www/htdocs/nm/xDown.sh
/apps/www/htdocs/nm/xDown.sh
2⤵
PID:745

/bin/ps
ps wuxm
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:596

/bin/grep
grep xDown.sh
1⤵
PID:597

/bin/grep
grep -v grep
1⤵
PID:598

/bin/grep
grep -v defunct
1⤵
PID:599

/usr/bin/wc
wc -l
1⤵
PID:600

/bin/ps
ps wuxm
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:612

/bin/grep
grep xDown.sh
1⤵
PID:613

/bin/grep
grep -v grep
1⤵
PID:614

/bin/grep
grep -v defunct
1⤵
PID:615

/usr/bin/wc
wc -l
1⤵
PID:616

/bin/ps
ps wuxm
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:738

/bin/grep
grep xDown.sh
1⤵
PID:739

/bin/grep
grep -v grep
1⤵
PID:740

/bin/grep
grep -v defunct
1⤵
PID:741

/usr/bin/wc
wc -l
1⤵
PID:742

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads