10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459

Analysis

max time kernel
0s
max time network
127s
platform
debian-9_armhf
resource
debian9-armhf-20221111-en
resource tags

arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
05-02-2023 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e603944aceb5c0885a8627de12f36b159bbf2f05
Size

3KB
MD5

d0d36f169f1458806053aae482af5010
SHA1

e603944aceb5c0885a8627de12f36b159bbf2f05
SHA256

10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459
SHA512

982abe39731d8cc852c25650740ff73975c10d19027eccf610401260e2f508334f1de656f8dd332fa698dccc9f7d3bda610c8b9e84d276036a6e9408d826229a

Score

9^/10

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
/bin/auto-backup.sh	/bin/auto-backup.sh	sh

Reads CPU attributes 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/12/stat	/proc/12/stat	ps
/proc/41/stat	/proc/41/stat	ps
/proc/287/stat	/proc/287/stat	ps
/proc/13/stat	/proc/13/stat	ps
/proc/380/stat	/proc/380/stat	ps
/proc/382/status	/proc/382/status	ps
/proc/24/status	/proc/24/status	ps
/proc/107/stat	/proc/107/stat	ps
/proc/162/status	/proc/162/status	ps
/proc/18/stat	/proc/18/stat	ps
/proc/368/stat	/proc/368/stat	ps
/proc/filesystems	/proc/filesystems	find
/proc/41/status	/proc/41/status	ps
/proc/106/stat	/proc/106/stat	ps
/proc/2/status	/proc/2/status	ps
/proc/14/stat	/proc/14/stat	ps
/proc/3/stat	/proc/3/stat	ps
/proc/310/status	/proc/310/status	ps
/proc/10/status	/proc/10/status	ps
/proc/106/stat	/proc/106/stat	ps
/proc/231/status	/proc/231/status	ps
/proc/11/stat	/proc/11/stat	ps
/proc/19/status	/proc/19/status	ps
/proc/29/status	/proc/29/status	ps
/proc/11/stat	/proc/11/stat	ps
/proc/24/stat	/proc/24/stat	ps
/proc/2/stat	/proc/2/stat	ps
/proc/9/status	/proc/9/status	ps
/proc/15/stat	/proc/15/stat	ps
/proc/18/status	/proc/18/status	ps
/proc/5/stat	/proc/5/stat	ps
/proc/11/status	/proc/11/status	ps
/proc/27/status	/proc/27/status	ps
/proc/328/stat	/proc/328/stat	ps
/proc/379/status	/proc/379/status	ps
/proc/filesystems	/proc/filesystems	ps
/proc/2/status	/proc/2/status	ps
/proc/328/status	/proc/328/status	ps
/proc/366/stat	/proc/366/stat	ps
/proc/15/status	/proc/15/status	ps
/proc/42/stat	/proc/42/stat	ps
/proc/95/status	/proc/95/status	ps
/proc/131/status	/proc/131/status	ps
/proc/4/stat	/proc/4/stat	ps
/proc/242/stat	/proc/242/stat	ps
/proc/13/status	/proc/13/status	ps
/proc/6/stat	/proc/6/stat	ps
/proc/18/stat	/proc/18/stat	ps
/proc/351/stat	/proc/351/stat	ps
/proc/351/status	/proc/351/status	ps
/proc/23/stat	/proc/23/stat	ps
/proc/242/status	/proc/242/status	ps
/proc/287/status	/proc/287/status	ps
/proc/362/status	/proc/362/status	ps
/proc/12/stat	/proc/12/stat	ps
/proc/42/status	/proc/42/status	ps
/proc/287/status	/proc/287/status	ps
/proc/308/stat	/proc/308/stat	ps
/proc/3/status	/proc/3/status	ps
/proc/6/status	/proc/6/status	ps
/proc/275/stat	/proc/275/stat	ps
/proc/meminfo	/proc/meminfo	ps
/proc/243/stat	/proc/243/stat	ps
/proc/354/status	/proc/354/status	ps

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/public.pem	/tmp/public.pem	rm
/tmp/archieve.zip	/tmp/archieve.zip	rm
/tmp/e603944aceb5c0885a8627de12f36b159bbf2f05	/tmp/e603944aceb5c0885a8627de12f36b159bbf2f05	rm
/tmp/e603944aceb5c0885a8627de12f36b159bbf2f05	/tmp/e603944aceb5c0885a8627de12f36b159bbf2f05	e603944aceb5c0885a8627de12f36b159bbf2f05
/tmp/encrypt	/tmp/encrypt	rm
/tmp/nohup.out	/tmp/nohup.out	rm
/tmp/index.html	/tmp/index.html	rm
/tmp/motd	/tmp/motd	rm

/tmp/e603944aceb5c0885a8627de12f36b159bbf2f05
/tmp/e603944aceb5c0885a8627de12f36b159bbf2f05
1⤵
- Writes file to tmp directory
PID:355
- /bin/chmod
  chmod +x /tmp//encrypt
  2⤵
  PID:370
- /usr/bin/find
  find /usr/lib/vmware -type f -name index.html
  2⤵
  - Reads runtime system information
  PID:375
- /bin/mv
  mv /etc/motd /etc/motd1
  2⤵
  PID:376
- /bin/cp
  cp /tmp//motd /etc/motd
  2⤵
  PID:377
- /bin/find
  /bin/find / -name "*.log" -exec /bin/rm -rf "{}" ";"
  2⤵
  PID:378
- /bin/rm
  /bin/rm -f /store/packages/vmtools.py
  2⤵
  PID:388
- /bin/touch
  /bin/touch -r /etc/vmware/rhttpproxy/config.xml /etc/vmware/rhttpproxy/endpoints.conf
  2⤵
  PID:389
- /bin/touch
  /bin/touch -r /etc/vmware/rhttpproxy/config.xml /bin/hostd-probe.sh
  2⤵
  PID:390
- /bin/touch
  /bin/touch -r /etc/vmware/rhttpproxy/config.xml /etc/rc.local.d/local.sh
  2⤵
  PID:391
- /bin/rm
  /bin/rm -f /tmp/encrypt /tmp/nohup.out /tmp/index.html /tmp/motd /tmp/public.pem /tmp/archieve.zip
  2⤵
  - Writes file to tmp directory
  PID:392
- /bin/sh
  /bin/sh /bin/auto-backup.sh
  2⤵
  - Writes file to system bin folder
  PID:393
- /bin/rm
  /bin/rm -- /tmp/e603944aceb5c0885a8627de12f36b159bbf2f05
  2⤵
  - Writes file to tmp directory
  PID:394
- /etc/init.d/SSH
  /etc/init.d/SSH start
  2⤵
  PID:395

/bin/grep
grep "Config File"
1⤵
PID:360

/usr/bin/awk
awk "{print \$3}"
1⤵
PID:361

/bin/ps
ps
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:367

/bin/grep
grep vmx
1⤵
PID:368

/usr/bin/awk
awk "{print \$2}"
1⤵
PID:369

/bin/grep
grep /vmfs/volumes/
1⤵
PID:373

/usr/bin/awk
awk "-F " "{print \$2}"
1⤵
PID:374

/bin/ps
/bin/ps
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:380

/bin/grep
/bin/grep encrypt
1⤵
PID:381

/bin/grep
/bin/grep -v grep
1⤵
PID:382

/bin/wc
/bin/wc -l
1⤵
PID:383

/bin/vmware
/bin/vmware -l
1⤵
PID:385

/bin/grep
/bin/grep " 7."
1⤵
PID:386

/bin/wc
/bin/wc -l
1⤵
PID:387

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads