6067706bedb66a64310723177a0aff44b71f7b8e1c464fd7ef292d34bd96cac2 | Triage

Analysis

max time kernel
0s
max time network
82s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
19-12-2022 16:55

Sharing

Report Analysis Logs

General

Target

6cb8808a846eb297c54d4dbf2130792bb7a35648
Size

535KB
MD5

5722ff1614a5185a4f21eac8ce40638c
SHA1

6cb8808a846eb297c54d4dbf2130792bb7a35648
SHA256

6067706bedb66a64310723177a0aff44b71f7b8e1c464fd7ef292d34bd96cac2
SHA512

34199ce4b786103e020af2c90a9ed7184d280133c3f085dccb58394f734ec9b17a7193ce19324c8af173d9bc46948ff01f39f7d921cb7d7de1198f478148d665
SSDEEP

12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbz+66ySjQn36Eojb:/fUywKQ7Fb1pNL/p5+fjQn36Eub

Score

9^/10

persistence

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 6 IoCs

Hijack Execution Flow

description	ioc
/bin/fwneaybqmv	/bin/fwneaybqmv
/bin/fnsysajoby	/bin/fnsysajoby
/bin/clxsnuwqsy	/bin/clxsnuwqsy
/bin/baydsjubrm	/bin/baydsjubrm
/bin/btntvtppmb	/bin/btntvtppmb
/bin/bcbskmghzw	/bin/bcbskmghzw

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Scheduled Task

description	ioc	Process
/etc/crontab	/etc/crontab	sed
/etc/crontab	/etc/crontab	sh

Modifies rc script 1 TTPs 12 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

Boot or Logon Autostart Execution

description	ioc	Process
/etc/rc2.d/S906cb8808a846eb297c54d4dbf2130792bb7a35648	/etc/rc2.d/S906cb8808a846eb297c54d4dbf2130792bb7a35648	Process not Found
/etc/rc5.d/S906cb8808a846eb297c54d4dbf2130792bb7a35648	/etc/rc5.d/S906cb8808a846eb297c54d4dbf2130792bb7a35648	Process not Found
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc1.d/S906cb8808a846eb297c54d4dbf2130792bb7a35648	/etc/rc1.d/S906cb8808a846eb297c54d4dbf2130792bb7a35648	Process not Found
/etc/rc3.d/S906cb8808a846eb297c54d4dbf2130792bb7a35648	/etc/rc3.d/S906cb8808a846eb297c54d4dbf2130792bb7a35648	Process not Found
/etc/rc4.d/S906cb8808a846eb297c54d4dbf2130792bb7a35648	/etc/rc4.d/S906cb8808a846eb297c54d4dbf2130792bb7a35648	Process not Found
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d

Write file to user bin folder 1 TTPs 7 IoCs

Hijack Execution Flow

description	ioc	Process
/usr/bin/fwneaybqmv	/usr/bin/fwneaybqmv	Process not Found
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d
/usr/bin/fnsysajoby	/usr/bin/fnsysajoby	Process not Found
/usr/bin/clxsnuwqsy	/usr/bin/clxsnuwqsy	Process not Found
/usr/bin/baydsjubrm	/usr/bin/baydsjubrm	Process not Found
/usr/bin/btntvtppmb	/usr/bin/btntvtppmb	Process not Found
/usr/bin/bcbskmghzw	/usr/bin/bcbskmghzw	Process not Found

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/1/environ	/proc/1/environ	systemctl
/proc/1/sched	/proc/1/sched	systemctl
/proc/cmdline	/proc/cmdline	systemctl
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	systemctl
/proc/self/stat	/proc/self/stat	systemctl
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
/tmp/bcbskmghzw	/tmp/bcbskmghzw
/tmp/fwneaybqmv	/tmp/fwneaybqmv
/tmp/fnsysajoby	/tmp/fnsysajoby
/tmp/clxsnuwqsy	/tmp/clxsnuwqsy
/tmp/baydsjubrm	/tmp/baydsjubrm
/tmp/btntvtppmb	/tmp/btntvtppmb

/tmp/6cb8808a846eb297c54d4dbf2130792bb7a35648
/tmp/6cb8808a846eb297c54d4dbf2130792bb7a35648
1⤵
PID:593

/bin/chkconfig
chkconfig --add 6cb8808a846eb297c54d4dbf2130792bb7a35648
1⤵
PID:596

/sbin/chkconfig
chkconfig --add 6cb8808a846eb297c54d4dbf2130792bb7a35648
1⤵
PID:596

/usr/bin/chkconfig
chkconfig --add 6cb8808a846eb297c54d4dbf2130792bb7a35648
1⤵
PID:596

/usr/sbin/chkconfig
chkconfig --add 6cb8808a846eb297c54d4dbf2130792bb7a35648
1⤵
PID:596

/usr/local/bin/chkconfig
chkconfig --add 6cb8808a846eb297c54d4dbf2130792bb7a35648
1⤵
PID:596

/usr/local/sbin/chkconfig
chkconfig --add 6cb8808a846eb297c54d4dbf2130792bb7a35648
1⤵
PID:596

/usr/X11R6/bin/chkconfig
chkconfig --add 6cb8808a846eb297c54d4dbf2130792bb7a35648
1⤵
PID:596

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:599
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:600

/bin/update-rc.d
update-rc.d 6cb8808a846eb297c54d4dbf2130792bb7a35648 defaults
1⤵
PID:598

/sbin/update-rc.d
update-rc.d 6cb8808a846eb297c54d4dbf2130792bb7a35648 defaults
1⤵
PID:598

/usr/bin/update-rc.d
update-rc.d 6cb8808a846eb297c54d4dbf2130792bb7a35648 defaults
1⤵
PID:598

/usr/sbin/update-rc.d
update-rc.d 6cb8808a846eb297c54d4dbf2130792bb7a35648 defaults
1⤵
- Modifies rc script
- Write file to user bin folder
PID:598
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:604

/usr/bin/clxsnuwqsy
/usr/bin/clxsnuwqsy bash 594
1⤵
PID:625

/usr/bin/clxsnuwqsy
/usr/bin/clxsnuwqsy whoami 594
1⤵
PID:628

/usr/bin/clxsnuwqsy
/usr/bin/clxsnuwqsy su 594
1⤵
PID:631

/usr/bin/clxsnuwqsy
/usr/bin/clxsnuwqsy "cd /etc" 594
1⤵
PID:634

/usr/bin/clxsnuwqsy
/usr/bin/clxsnuwqsy id 594
1⤵
PID:637

/usr/bin/baydsjubrm
/usr/bin/baydsjubrm top 594
1⤵
PID:640

/usr/bin/baydsjubrm
/usr/bin/baydsjubrm uptime 594
1⤵
PID:643

/usr/bin/baydsjubrm
/usr/bin/baydsjubrm "netstat -antop" 594
1⤵
PID:646

/usr/bin/baydsjubrm
/usr/bin/baydsjubrm gnome-terminal 594
1⤵
PID:649

/usr/bin/baydsjubrm
/usr/bin/baydsjubrm "netstat -antop" 594
1⤵
PID:652

/usr/bin/btntvtppmb
/usr/bin/btntvtppmb "sleep 1" 594
1⤵
PID:655

/usr/bin/btntvtppmb
/usr/bin/btntvtppmb "grep \"A\"" 594
1⤵
PID:658

/usr/bin/btntvtppmb
/usr/bin/btntvtppmb "ps -ef" 594
1⤵
PID:661

/usr/bin/btntvtppmb
/usr/bin/btntvtppmb "grep \"A\"" 594
1⤵
PID:664

/usr/bin/btntvtppmb
/usr/bin/btntvtppmb "route -n" 594
1⤵
PID:667

/usr/bin/bcbskmghzw
/usr/bin/bcbskmghzw "echo \"find\"" 594
1⤵
PID:670

/usr/bin/bcbskmghzw
/usr/bin/bcbskmghzw "ifconfig eth0" 594
1⤵
PID:673

/usr/bin/bcbskmghzw
/usr/bin/bcbskmghzw pwd 594
1⤵
PID:676

/usr/bin/bcbskmghzw
/usr/bin/bcbskmghzw "netstat -antop" 594
1⤵
PID:679

/usr/bin/bcbskmghzw
/usr/bin/bcbskmghzw "cd /etc" 594
1⤵
PID:682

/usr/bin/fwneaybqmv
/usr/bin/fwneaybqmv "netstat -an" 594
1⤵
PID:685

/usr/bin/fwneaybqmv
/usr/bin/fwneaybqmv su 594
1⤵
PID:688

/usr/bin/fwneaybqmv
/usr/bin/fwneaybqmv ifconfig 594
1⤵
PID:691

/usr/bin/fwneaybqmv
/usr/bin/fwneaybqmv su 594
1⤵
PID:694

/usr/bin/fwneaybqmv
/usr/bin/fwneaybqmv "route -n" 594
1⤵
PID:697

/usr/bin/hxhcqjwghw
/usr/bin/hxhcqjwghw ls 594
1⤵
PID:702

/usr/bin/hxhcqjwghw
/usr/bin/hxhcqjwghw "grep \"A\"" 594
1⤵
PID:700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Hijack Execution Flow

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Hijack Execution Flow

Scheduled Task

Defense Evasion

Hijack Execution Flow

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads