4616bc3ba5c245946819c55db573b552ba1c0cc5e0c54c433ffb1824452fc609

Resubmissions

20/04/2023, 08:24

230420-kaymzsge82 10

15/03/2023, 09:30

230315-lgjyvaee3z 10

11/01/2023, 05:39

230111-gcqhlsae84 10

19/12/2022, 18:02

221219-wmhyvaag2t 10

Analysis

max time kernel
0s
max time network
107s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
19/12/2022, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
Size

611KB
MD5

ba0d7400c3d3cb1305f17143fcfa6b56
SHA1

c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
SHA256

4616bc3ba5c245946819c55db573b552ba1c0cc5e0c54c433ffb1824452fc609
SHA512

27e18100ef4320895704800798ad2aa6fc569ee296f4f02dd43a828667fe6333670fee31391ec27438a9c141aa9313a9e6a98423e627a39f73ec77ba12953529
SSDEEP

12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4UlUuTh1Aw:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl/91F

Score

9^/10

persistence

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 6 IoCs

Hijack Execution Flow

T1574

description	ioc
/bin/zbwaleafol	/bin/zbwaleafol
/bin/yusmllnbhv	/bin/yusmllnbhv
/bin/olrfijxurn	/bin/olrfijxurn
/bin/filvkefgqw	/bin/filvkefgqw
/bin/ybhpjjbvqu	/bin/ybhpjjbvqu
/bin/lpgsstohka	/bin/lpgsstohka

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task

T1053

description	ioc	Process
/etc/crontab	/etc/crontab	sed
/etc/crontab	/etc/crontab	sh

Modifies rc script 1 TTPs 12 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
/etc/rc1.d/S90c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02	/etc/rc1.d/S90c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02	Process not Found
/etc/rc2.d/S90c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02	/etc/rc2.d/S90c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02	Process not Found
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d
/etc/rc3.d/S90c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02	/etc/rc3.d/S90c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02	Process not Found
/etc/rc4.d/S90c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02	/etc/rc4.d/S90c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02	Process not Found
/etc/rc5.d/S90c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02	/etc/rc5.d/S90c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02	Process not Found
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc4.d/	/etc/rc4.d/	update-rc.d

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	54.36.15.98
Destination IP	51.89.52.12

Write file to user bin folder 1 TTPs 7 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
/usr/bin/ybhpjjbvqu	/usr/bin/ybhpjjbvqu	Process not Found
/usr/bin/lpgsstohka	/usr/bin/lpgsstohka	Process not Found
/usr/bin/zbwaleafol	/usr/bin/zbwaleafol	Process not Found
/usr/bin/yusmllnbhv	/usr/bin/yusmllnbhv	Process not Found
/usr/bin/olrfijxurn	/usr/bin/olrfijxurn	Process not Found
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d
/usr/bin/filvkefgqw	/usr/bin/filvkefgqw	Process not Found

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/1/environ	/proc/1/environ	systemctl
/proc/1/sched	/proc/1/sched	systemctl
/proc/cmdline	/proc/cmdline	systemctl
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	systemctl
/proc/self/stat	/proc/self/stat	systemctl
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
/tmp/filvkefgqw	/tmp/filvkefgqw
/tmp/ybhpjjbvqu	/tmp/ybhpjjbvqu
/tmp/lpgsstohka	/tmp/lpgsstohka
/tmp/zbwaleafol	/tmp/zbwaleafol
/tmp/yusmllnbhv	/tmp/yusmllnbhv
/tmp/olrfijxurn	/tmp/olrfijxurn

/tmp/c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
/tmp/c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
1⤵
PID:593

/bin/chkconfig
chkconfig --add c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
1⤵
PID:596

/sbin/chkconfig
chkconfig --add c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
1⤵
PID:596

/usr/bin/chkconfig
chkconfig --add c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
1⤵
PID:596

/usr/sbin/chkconfig
chkconfig --add c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
1⤵
PID:596

/usr/local/bin/chkconfig
chkconfig --add c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
1⤵
PID:596

/usr/local/sbin/chkconfig
chkconfig --add c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
1⤵
PID:596

/usr/X11R6/bin/chkconfig
chkconfig --add c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
1⤵
PID:596

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:599
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:600

/bin/update-rc.d
update-rc.d c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02 defaults
1⤵
PID:598

/sbin/update-rc.d
update-rc.d c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02 defaults
1⤵
PID:598

/usr/bin/update-rc.d
update-rc.d c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02 defaults
1⤵
PID:598

/usr/sbin/update-rc.d
update-rc.d c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02 defaults
1⤵
- Modifies rc script
- Write file to user bin folder
PID:598
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:604

/usr/bin/ybhpjjbvqu
/usr/bin/ybhpjjbvqu "netstat -antop" 594
1⤵
PID:626

/usr/bin/ybhpjjbvqu
/usr/bin/ybhpjjbvqu ls 594
1⤵
PID:629

/usr/bin/ybhpjjbvqu
/usr/bin/ybhpjjbvqu whoami 594
1⤵
PID:632

/usr/bin/ybhpjjbvqu
/usr/bin/ybhpjjbvqu pwd 594
1⤵
PID:635

/usr/bin/ybhpjjbvqu
/usr/bin/ybhpjjbvqu pwd 594
1⤵
PID:638

/usr/bin/lpgsstohka
/usr/bin/lpgsstohka id 594
1⤵
PID:641

/usr/bin/lpgsstohka
/usr/bin/lpgsstohka "echo \"find\"" 594
1⤵
PID:644

/usr/bin/lpgsstohka
/usr/bin/lpgsstohka whoami 594
1⤵
PID:647

/usr/bin/lpgsstohka
/usr/bin/lpgsstohka ls 594
1⤵
PID:650

/usr/bin/lpgsstohka
/usr/bin/lpgsstohka who 594
1⤵
PID:653

/usr/bin/zbwaleafol
/usr/bin/zbwaleafol "netstat -antop" 594
1⤵
PID:656

/usr/bin/zbwaleafol
/usr/bin/zbwaleafol who 594
1⤵
PID:659

/usr/bin/zbwaleafol
/usr/bin/zbwaleafol "ifconfig eth0" 594
1⤵
PID:662

/usr/bin/zbwaleafol
/usr/bin/zbwaleafol whoami 594
1⤵
PID:665

/usr/bin/zbwaleafol
/usr/bin/zbwaleafol ls 594
1⤵
PID:668

/usr/bin/yusmllnbhv
/usr/bin/yusmllnbhv "ps -ef" 594
1⤵
PID:671

/usr/bin/yusmllnbhv
/usr/bin/yusmllnbhv "ifconfig eth0" 594
1⤵
PID:674

/usr/bin/yusmllnbhv
/usr/bin/yusmllnbhv "netstat -antop" 594
1⤵
PID:677

/usr/bin/yusmllnbhv
/usr/bin/yusmllnbhv ifconfig 594
1⤵
PID:680

/usr/bin/yusmllnbhv
/usr/bin/yusmllnbhv "sleep 1" 594
1⤵
PID:683

/usr/bin/olrfijxurn
/usr/bin/olrfijxurn sh 594
1⤵
PID:686

/usr/bin/olrfijxurn
/usr/bin/olrfijxurn gnome-terminal 594
1⤵
PID:689

/usr/bin/olrfijxurn
/usr/bin/olrfijxurn "echo \"find\"" 594
1⤵
PID:692

/usr/bin/olrfijxurn
/usr/bin/olrfijxurn "netstat -an" 594
1⤵
PID:695

/usr/bin/olrfijxurn
/usr/bin/olrfijxurn "cat resolv.conf" 594
1⤵
PID:698

/usr/bin/dgpknzvptm
/usr/bin/dgpknzvptm uptime 594
1⤵
PID:701

/usr/bin/dgpknzvptm
/usr/bin/dgpknzvptm "cat resolv.conf" 594
1⤵
PID:703

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task

T1053

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads