4aaa0b0d1ccb91b090df97a47b15536157f6f141cdce67867d339d0f01b3981d

Analysis

max time kernel
0s
max time network
48s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
27/11/2022, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4aaa0b0d1ccb91b090df97a47b15536157f6f141cdce67867d339d0f01b3981d
Size 659KB
Sample221127-wbd6hsfc58
SHA256 4aaa0b0d1ccb91b090df97a47b15536157f6f141cdce67867d339d0f01b3981d
MD5 1d79488a09ef56ae2e60e1985b18e7a2
SHA1 0b25e8f36a9738bb4d2dd2cd711f1aa7213db517
SHA512 b77fda07473e8f3e7ff2a1e25bb556164e3fddb40fe791a0b96538dfcc766f96c6e15082dccc77e79fff73f34497d0c43643134a633ff8740bbc4a287ec0c91b
SSDEEP 12288:aBo9ETRNT9Wn1J0OhS18tDm8PCExfLZ9JCCpyvOH36ybCQ7YLVN1/lFkThVArw:aBo9ANo70OE8A8PCExfLZ/CTvQrKLd/Q
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Modifies rc script 1 TTPs 12 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc2.d/S90iycidrkhlc	/etc/rc2.d/S90iycidrkhlc	Process not Found
/etc/rc3.d/S90iycidrkhlc	/etc/rc3.d/S90iycidrkhlc	Process not Found
/etc/rc4.d/S90iycidrkhlc	/etc/rc4.d/S90iycidrkhlc	Process not Found
/etc/rc5.d/S90iycidrkhlc	/etc/rc5.d/S90iycidrkhlc	Process not Found
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc1.d/S90iycidrkhlc	/etc/rc1.d/S90iycidrkhlc	Process not Found
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d

Unexpected DNS network traffic destination 6 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228

Write file to user bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d

Reads runtime system information 6 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	systemctl
/proc/self/stat	/proc/self/stat	systemctl
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl
/proc/1/environ	/proc/1/environ	systemctl
/proc/1/sched	/proc/1/sched	systemctl
/proc/cmdline	/proc/cmdline	systemctl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
/tmp/4aaa0b0d1ccb91b090df97a47b15536157f6f141cdce67867d339d0f01b3981d	/tmp/4aaa0b0d1ccb91b090df97a47b15536157f6f141cdce67867d339d0f01b3981d

/tmp/4aaa0b0d1ccb91b090df97a47b15536157f6f141cdce67867d339d0f01b3981d
/tmp/4aaa0b0d1ccb91b090df97a47b15536157f6f141cdce67867d339d0f01b3981d
1⤵
PID:607

/boot/iycidrkhlc
/boot/iycidrkhlc
1⤵
PID:610

/bin/chkconfig
chkconfig --add iycidrkhlc
1⤵
PID:613

/sbin/chkconfig
chkconfig --add iycidrkhlc
1⤵
PID:613

/usr/bin/chkconfig
chkconfig --add iycidrkhlc
1⤵
PID:613

/usr/sbin/chkconfig
chkconfig --add iycidrkhlc
1⤵
PID:613

/usr/local/bin/chkconfig
chkconfig --add iycidrkhlc
1⤵
PID:613

/usr/local/sbin/chkconfig
chkconfig --add iycidrkhlc
1⤵
PID:613

/usr/X11R6/bin/chkconfig
chkconfig --add iycidrkhlc
1⤵
PID:613

/bin/update-rc.d
update-rc.d iycidrkhlc defaults
1⤵
PID:615

/sbin/update-rc.d
update-rc.d iycidrkhlc defaults
1⤵
PID:615

/usr/bin/update-rc.d
update-rc.d iycidrkhlc defaults
1⤵
PID:615

/usr/sbin/update-rc.d
update-rc.d iycidrkhlc defaults
1⤵
- Modifies rc script
- Write file to user bin folder
PID:615
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:618

/boot/yjgtlmmyht
/boot/yjgtlmmyht "route -n" 611
1⤵
PID:640

/boot/yjgtlmmyht
/boot/yjgtlmmyht pwd 611
1⤵
PID:643

/boot/yjgtlmmyht
/boot/yjgtlmmyht uptime 611
1⤵
PID:646

/boot/yjgtlmmyht
/boot/yjgtlmmyht whoami 611
1⤵
PID:649

/boot/yjgtlmmyht
/boot/yjgtlmmyht bash 611
1⤵
PID:652

/boot/yjrvfvgdfw
/boot/yjrvfvgdfw pwd 611
1⤵
PID:655

/boot/yjrvfvgdfw
/boot/yjrvfvgdfw "netstat -antop" 611
1⤵
PID:658

/boot/yjrvfvgdfw
/boot/yjrvfvgdfw su 611
1⤵
PID:661

/boot/yjrvfvgdfw
/boot/yjrvfvgdfw su 611
1⤵
PID:664

/boot/yjrvfvgdfw
/boot/yjrvfvgdfw "ps -ef" 611
1⤵
PID:667

/boot/vcsgpxgewa
/boot/vcsgpxgewa "netstat -an" 611
1⤵
PID:670

/boot/vcsgpxgewa
/boot/vcsgpxgewa gnome-terminal 611
1⤵
PID:673

/boot/vcsgpxgewa
/boot/vcsgpxgewa ifconfig 611
1⤵
PID:676

/boot/vcsgpxgewa
/boot/vcsgpxgewa ls 611
1⤵
PID:679

/boot/vcsgpxgewa
/boot/vcsgpxgewa whoami 611
1⤵
PID:682

/boot/ycwyrrdpve
/boot/ycwyrrdpve "echo \"find\"" 611
1⤵
PID:685

/boot/ycwyrrdpve
/boot/ycwyrrdpve "ls -la" 611
1⤵
PID:688

/boot/ycwyrrdpve
/boot/ycwyrrdpve "ps -ef" 611
1⤵
PID:691

/boot/ycwyrrdpve
/boot/ycwyrrdpve "netstat -an" 611
1⤵
PID:694

/boot/ycwyrrdpve
/boot/ycwyrrdpve "netstat -an" 611
1⤵
PID:697

/boot/bfqzokpeob
/boot/bfqzokpeob bash 611
1⤵
PID:700

/boot/bfqzokpeob
/boot/bfqzokpeob "ls -la" 611
1⤵
PID:702

/boot/bfqzokpeob
/boot/bfqzokpeob bash 611
1⤵
PID:705

/boot/bfqzokpeob
/boot/bfqzokpeob "netstat -antop" 611
1⤵
PID:708

/boot/bfqzokpeob
/boot/bfqzokpeob su 611
1⤵
PID:711

/boot/ifacvkggyl
/boot/ifacvkggyl gnome-terminal 611
1⤵
PID:714

/boot/ifacvkggyl
/boot/ifacvkggyl bash 611
1⤵
PID:716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads