Overview

overview

10

Static

static

10

c78b8f0a5a...b2cf02

ubuntu-18.04-amd64

9

Resubmissions

20-04-2023 08:24

230420-kaymzsge82 10

15-03-2023 09:30

230315-lgjyvaee3z 10

11-01-2023 05:39

230111-gcqhlsae84 10

19-12-2022 18:02

221219-wmhyvaag2t 10

Analysis

  • max time kernel
    0s
  • max time network
    37s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20221111-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    11-01-2023 05:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02

  • Size

    611KB

  • MD5

    ba0d7400c3d3cb1305f17143fcfa6b56

  • SHA1

    c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02

  • SHA256

    4616bc3ba5c245946819c55db573b552ba1c0cc5e0c54c433ffb1824452fc609

  • SHA512

    27e18100ef4320895704800798ad2aa6fc569ee296f4f02dd43a828667fe6333670fee31391ec27438a9c141aa9313a9e6a98423e627a39f73ec77ba12953529

  • SSDEEP

    12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4UlUuTh1Aw:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl/91F

Score
9/10
persistence

Malware Config

Signatures

  • Writes file to system bin folder 1 TTPs 5 IoCs
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  • Modifies init.d 1 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 1 TTPs 17 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Write file to user bin folder 1 TTPs 6 IoCs
  • Reads runtime system information 7 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 5 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
    /tmp/c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
    1⤵
      PID:600
    • /bin/chkconfig
      chkconfig --add c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
      1⤵
        PID:603
      • /sbin/chkconfig
        chkconfig --add c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
        1⤵
          PID:603
        • /usr/bin/chkconfig
          chkconfig --add c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
          1⤵
            PID:603
          • /usr/sbin/chkconfig
            chkconfig --add c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
            1⤵
              PID:603
            • /usr/local/bin/chkconfig
              chkconfig --add c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
              1⤵
                PID:603
              • /usr/local/sbin/chkconfig
                chkconfig --add c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
                1⤵
                  PID:603
                • /usr/X11R6/bin/chkconfig
                  chkconfig --add c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02
                  1⤵
                    PID:603
                  • /bin/sh
                    sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
                    1⤵
                    • Creates/modifies Cron job
                    PID:606
                    • /bin/sed
                      sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
                      2⤵
                      • Creates/modifies Cron job
                      • Reads runtime system information
                      PID:607
                  • /bin/update-rc.d
                    update-rc.d c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02 defaults
                    1⤵
                      PID:605
                    • /sbin/update-rc.d
                      update-rc.d c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02 defaults
                      1⤵
                        PID:605
                      • /usr/bin/update-rc.d
                        update-rc.d c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02 defaults
                        1⤵
                          PID:605
                        • /usr/sbin/update-rc.d
                          update-rc.d c78b8f0a5aaf3bac7cbffc9234d715f638b2cf02 defaults
                          1⤵
                          • Modifies rc script
                          • Write file to user bin folder
                          PID:605
                          • /bin/systemctl
                            systemctl daemon-reload
                            2⤵
                            • Reads runtime system information
                            PID:610
                        • /usr/bin/yiawzhoozv
                          /usr/bin/yiawzhoozv whoami 601
                          1⤵
                            PID:617
                          • /usr/bin/yiawzhoozv
                            /usr/bin/yiawzhoozv "route -n" 601
                            1⤵
                              PID:635
                            • /usr/bin/yiawzhoozv
                              /usr/bin/yiawzhoozv bash 601
                              1⤵
                                PID:638
                              • /usr/bin/yiawzhoozv
                                /usr/bin/yiawzhoozv pwd 601
                                1⤵
                                  PID:641
                                • /usr/bin/yiawzhoozv
                                  /usr/bin/yiawzhoozv ifconfig 601
                                  1⤵
                                    PID:644
                                  • /usr/bin/gteouwpzqz
                                    /usr/bin/gteouwpzqz "netstat -an" 601
                                    1⤵
                                      PID:647
                                    • /usr/bin/gteouwpzqz
                                      /usr/bin/gteouwpzqz "netstat -an" 601
                                      1⤵
                                        PID:650
                                      • /usr/bin/gteouwpzqz
                                        /usr/bin/gteouwpzqz su 601
                                        1⤵
                                          PID:653
                                        • /usr/bin/gteouwpzqz
                                          /usr/bin/gteouwpzqz top 601
                                          1⤵
                                            PID:656
                                          • /usr/bin/gteouwpzqz
                                            /usr/bin/gteouwpzqz who 601
                                            1⤵
                                              PID:659
                                            • /usr/bin/vniemyddct
                                              /usr/bin/vniemyddct "echo \"find\"" 601
                                              1⤵
                                                PID:662
                                              • /usr/bin/vniemyddct
                                                /usr/bin/vniemyddct sh 601
                                                1⤵
                                                  PID:665
                                                • /usr/bin/vniemyddct
                                                  /usr/bin/vniemyddct "ifconfig eth0" 601
                                                  1⤵
                                                    PID:668
                                                  • /usr/bin/vniemyddct
                                                    /usr/bin/vniemyddct sh 601
                                                    1⤵
                                                      PID:671
                                                    • /usr/bin/vniemyddct
                                                      /usr/bin/vniemyddct id 601
                                                      1⤵
                                                        PID:674
                                                      • /usr/bin/yfstzbcbde
                                                        /usr/bin/yfstzbcbde "ls -la" 601
                                                        1⤵
                                                          PID:677
                                                        • /usr/bin/yfstzbcbde
                                                          /usr/bin/yfstzbcbde "sleep 1" 601
                                                          1⤵
                                                            PID:680
                                                          • /usr/bin/yfstzbcbde
                                                            /usr/bin/yfstzbcbde "netstat -an" 601
                                                            1⤵
                                                              PID:683
                                                            • /usr/bin/yfstzbcbde
                                                              /usr/bin/yfstzbcbde ifconfig 601
                                                              1⤵
                                                                PID:686
                                                              • /usr/bin/yfstzbcbde
                                                                /usr/bin/yfstzbcbde who 601
                                                                1⤵
                                                                  PID:689
                                                                • /usr/bin/xasbnpnizx
                                                                  /usr/bin/xasbnpnizx ls 601
                                                                  1⤵
                                                                    PID:692
                                                                  • /usr/bin/xasbnpnizx
                                                                    /usr/bin/xasbnpnizx bash 601
                                                                    1⤵
                                                                      PID:695
                                                                    • /usr/bin/xasbnpnizx
                                                                      /usr/bin/xasbnpnizx su 601
                                                                      1⤵
                                                                        PID:698
                                                                      • /usr/bin/xasbnpnizx
                                                                        /usr/bin/xasbnpnizx "ls -la" 601
                                                                        1⤵
                                                                          PID:701
                                                                        • /usr/bin/xasbnpnizx
                                                                          /usr/bin/xasbnpnizx "cat resolv.conf" 601
                                                                          1⤵
                                                                            PID:704
                                                                          • /usr/bin/yiklixkznj
                                                                            /usr/bin/yiklixkznj "route -n" 601
                                                                            1⤵
                                                                              PID:707
                                                                            • /usr/bin/yiklixkznj
                                                                              /usr/bin/yiklixkznj gnome-terminal 601
                                                                              1⤵
                                                                                PID:709

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v6

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads