Analysis
-
max time kernel
31002s -
max time network
155s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
30-11-2022 14:15
Behavioral task
behavioral1
Sample
6059162cbc124837b2ec0c1e7c9ffcabe3b8f3a0d37ed85dd2c1df95a7731d18
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
6059162cbc124837b2ec0c1e7c9ffcabe3b8f3a0d37ed85dd2c1df95a7731d18
-
Size
647KB
-
MD5
30a40fa230165defa421615ab9cfae20
-
SHA1
3d9f11764e0a479361117749211295d8aa2626da
-
SHA256
6059162cbc124837b2ec0c1e7c9ffcabe3b8f3a0d37ed85dd2c1df95a7731d18
-
SHA512
cedcf09cf55c4aa554321814278f6dc8c2e883a228c766833b3d2aa22c5b1d5f72e1aeced3fe671a0247d08b6ea51765362934db3987153c82ccbe5ed36457c1
-
SSDEEP
12288:RBRO1UmJJ0nHgBL9YfJip2qm+x4h1TonTp6y07l7mtBDvnD/u9hMHDB:RBRpmJ+HyL9AiAqm+x4h1mT6wvnDWXMN
Malware Config
Signatures
-
Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
sedshdescription ioc Process /etc/crontab /etc/crontab sed /etc/crontab /etc/crontab sh -
Modifies rc script 1 TTPs 12 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
Processes:
update-rc.ddescription ioc Process /etc/rc3.d/S90opashhorxe /etc/rc3.d/S90opashhorxe