Analysis
-
max time kernel
0s -
max time network
136s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
28-11-2022 10:50
Behavioral task
behavioral1
Sample
b034b26b1d08f1d86ecffff6cde9568708af7bf86e743292f6b74c83dc25d1ae
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
4 signatures
150 seconds
General
-
Target
b034b26b1d08f1d86ecffff6cde9568708af7bf86e743292f6b74c83dc25d1ae
-
Size
1.2MB
-
MD5
d5bbd9289746dfbcf84812581377a329
-
SHA1
751c5070b80b796a57667ae5d6770dc75beccf49
-
SHA256
b034b26b1d08f1d86ecffff6cde9568708af7bf86e743292f6b74c83dc25d1ae
-
SHA512
4e3139d8c6b0c257041dbf94b4a96359bf09f3866abd1b87615bd54435c5558196f9b8750a5c8b003a889b6c0191855380c4c6ba9f68010023b47c8855d79127
-
SSDEEP
24576:e845rGHu6gVJKG75oFpA0VWIX4Q2y1q2rJp0:745vRVJKGtSA0VWIonu9p0
Score
9/10
Malware Config
Signatures
-
Writes file to system bin folder 1 TTPs 4 IoCs
Processes:
cpcpcpcpdescription ioc process /bin/ps /bin/ps cp /bin/ps /bin/ps cp /bin/ss /bin/ss cp /bin/ss /bin/ss cp -
Write file to user bin folder 1 TTPs 12 IoCs
Processes:
cpcpcpcpcpcpcpcpdescription ioc process /usr/bin/.sshd /usr/bin/.sshd cp /usr/bin/dpkgd/ps /usr/bin/dpkgd/ps cp /usr/bin/bsd-port/getty /usr/bin/bsd-port/getty cp /usr/bin/bsd-port/getty /usr/bin/bsd-port/getty cp /usr/bin/lsof /usr/bin/lsof cp /usr/bin/dpkgd/lsof /usr/bin/dpkgd/lsof cp /usr/bin/bsd-port/getty /usr/bin/bsd-port/getty cp /usr/bin/lsof /usr/bin/lsof cp /usr/bin/bsd-port/udevd.lock /usr/bin/bsd-port/udevd.lock /usr/bin/bsd-port/getty /usr/bin/bsd-port/getty cp /usr/bin/dpkgd/ss /usr/bin/dpkgd/ss cp /usr/bin/bsd-port/update_temporary /usr/bin/bsd-port/update_temporary -
Reads runtime system information 21 IoCs
Reads data from /proc virtual filesystem.
Processes:
cpmkdirmkdircpmkdirmkdircpmkdircpmkdircpinsmodmkdirmkdircpcpmkdirmkdirmkdirinsmodcpdescription ioc process /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems cp /proc/cmdline /proc/cmdline insmod /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems cp /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems mkdir /proc/cmdline /proc/cmdline insmod /proc/filesystems /proc/filesystems cp -
Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
Processes:
cpcpdescription ioc /tmp/notify.file /tmp/notify.file /tmp/update_temporary /tmp/update_temporary /tmp/bill.lock /tmp/bill.lock /tmp/b034b26b1d08f1d86ecffff6cde9568708af7bf86e743292f6b74c83dc25d1ae /tmp/b034b26b1d08f1d86ecffff6cde9568708af7bf86e743292f6b74c83dc25d1ae cp /tmp/b034b26b1d08f1d86ecffff6cde9568708af7bf86e743292f6b74c83dc25d1ae /tmp/b034b26b1d08f1d86ecffff6cde9568708af7bf86e743292f6b74c83dc25d1ae cp
Processes
-
/tmp/b034b26b1d08f1d86ecffff6cde9568708af7bf86e743292f6b74c83dc25d1ae/tmp/b034b26b1d08f1d86ecffff6cde9568708af7bf86e743292f6b74c83dc25d1ae1⤵
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt2⤵
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt2⤵
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt2⤵
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt2⤵
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt2⤵
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /tmp/b034b26b1d08f1d86ecffff6cde9568708af7bf86e743292f6b74c83dc25d1ae /usr/bin/bsd-port/getty"1⤵
-
/bin/cpcp -f /tmp/b034b26b1d08f1d86ecffff6cde9568708af7bf86e743292f6b74c83dc25d1ae /usr/bin/bsd-port/getty2⤵
- Write file to user bin folder
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c /usr/bin/bsd-port/getty1⤵
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty2⤵
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /tmp/b034b26b1d08f1d86ecffff6cde9568708af7bf86e743292f6b74c83dc25d1ae /usr/bin/.sshd"1⤵
-
/bin/cpcp -f /tmp/b034b26b1d08f1d86ecffff6cde9568708af7bf86e743292f6b74c83dc25d1ae /usr/bin/.sshd2⤵
- Write file to user bin folder
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux2⤵
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux2⤵
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux2⤵
-
/bin/shsh -c /usr/bin/.sshd1⤵
-
/usr/bin/.sshd/usr/bin/.sshd2⤵
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux2⤵
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux2⤵
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"1⤵
-
/bin/mkdirmkdir -p /usr/bin/dpkgd2⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"1⤵
-
/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps2⤵
- Writes file to system bin folder
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /bin"1⤵
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /bin"1⤵
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"1⤵
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ps2⤵
- Writes file to system bin folder
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c "chmod 0755 /bin/ps"1⤵
-
/bin/chmodchmod 0755 /bin/ps2⤵
-
/bin/shsh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"1⤵
-
/bin/cpcp -f /bin/ss /usr/bin/dpkgd/ss2⤵
- Writes file to system bin folder
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /bin"1⤵
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /bin"1⤵
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"1⤵
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ss2⤵
- Writes file to system bin folder
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c "chmod 0755 /bin/ss"1⤵
-
/bin/chmodchmod 0755 /bin/ss2⤵
-
/bin/shsh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"1⤵
-
/bin/cpcp -f /usr/bin/lsof /usr/bin/dpkgd/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"1⤵
-
/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"1⤵
-
/bin/chmodchmod 0755 /usr/bin/lsof2⤵
-
/bin/shsh -c "insmod /usr/bin/bsd-port/xpacket.ko"1⤵
-
/sbin/insmodinsmod /usr/bin/bsd-port/xpacket.ko2⤵
- Reads runtime system information
-
/bin/shsh -c "insmod /tmp/xpacket.ko"1⤵
-
/sbin/insmodinsmod /tmp/xpacket.ko2⤵
- Reads runtime system information