Overview

overview

5

Static

static

9536a1518f...05b5d8

ubuntu-18.04-amd64

5

9536a1518f...05b5d8

debian-9-armhf

5

9536a1518f...05b5d8

debian-9-mips

5

9536a1518f...05b5d8

debian-9-mipsel

5

Analysis

  • max time kernel
    0s
  • max time network
    135s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20221111-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    26-11-2022 16:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9536a1518fd4fc81c51ce508f99637e1b3f5756e36896f19ad78b21d0005b5d8

  • Size

    753B

  • MD5

    8bf07c56cdca230ea451333790002498

  • SHA1

    1e6470a691ff425e9b313df92d50ee531a57e037

  • SHA256

    9536a1518fd4fc81c51ce508f99637e1b3f5756e36896f19ad78b21d0005b5d8

  • SHA512

    7f513c376376f86cdd63b10735da1a6f1587aa5a4d51321a8bdd71e21e05541d109649f0eaa18c8591653642d582cc08878d72f1c71c42eab7ed472b8c20d62c

Score
5/10

Malware Config

Signatures

  • Writes file to tmp directory 18 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/9536a1518fd4fc81c51ce508f99637e1b3f5756e36896f19ad78b21d0005b5d8
    /tmp/9536a1518fd4fc81c51ce508f99637e1b3f5756e36896f19ad78b21d0005b5d8
    1⤵
    • Writes file to tmp directory
    PID:605
    • /bin/cat
      cat
      2⤵
        PID:606
      • /usr/bin/gcc
        gcc -w -fPIC -shared -o /tmp/libxpl.so /tmp/libxpl.c
        2⤵
        • Writes file to tmp directory
        PID:607
      • /bin/ping
        ping
        2⤵
          PID:616
        • /bin/cat
          cat /tmp/libxpl.so
          2⤵
          • Writes file to tmp directory
          PID:617
        • /bin/rm
          rm -rf /tmp/libxpl.c /tmp/libxpl.so
          2⤵
          • Writes file to tmp directory
          PID:618
        • /bin/ping
          ping
          2⤵
            PID:619
          • /bin/sh
            /bin/sh -i
            2⤵
              PID:619
          • /usr/lib/gcc/x86_64-linux-gnu/7/cc1
            /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu /tmp/libxpl.c -quiet -dumpbase libxpl.c "-mtune=generic" "-march=x86-64" -auxbase libxpl -w -fPIC -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccVvkauc.s
            1⤵
            • Writes file to tmp directory
            PID:608
          • /usr/local/sbin/as
            as -W --64 -o /tmp/ccDbmMpa.o /tmp/ccVvkauc.s
            1⤵
              PID:609
            • /usr/local/bin/as
              as -W --64 -o /tmp/ccDbmMpa.o /tmp/ccVvkauc.s
              1⤵
                PID:609
              • /usr/sbin/as
                as -W --64 -o /tmp/ccDbmMpa.o /tmp/ccVvkauc.s
                1⤵
                  PID:609
                • /usr/bin/as
                  as -W --64 -o /tmp/ccDbmMpa.o /tmp/ccVvkauc.s
                  1⤵
                  • Writes file to tmp directory
                  PID:609
                • /usr/lib/gcc/x86_64-linux-gnu/7/collect2
                  /usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccuumWyJ.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -shared -z relro -o /tmp/libxpl.so /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccDbmMpa.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
                  1⤵
                  • Writes file to tmp directory
                  PID:614
                • /usr/bin/ld
                  /usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccuumWyJ.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -shared -z relro -o /tmp/libxpl.so /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccDbmMpa.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
                  1⤵
                  • Writes file to tmp directory
                  PID:615

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads