Analysis
-
max time kernel
0s -
max time network
153s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20221111-en -
resource tags
-
submitted
16-02-2023 02:18
General
-
Target
d23c943cdb07744ec8d7cc82028966dd
-
Size
54KB
-
MD5
d23c943cdb07744ec8d7cc82028966dd
-
SHA1
a229784c46247c40074d4ea92ead1f70a39c0b7a
-
SHA256
ceb503189360c97b79ab8e6bd2d8ea452bdaa2f5b8a1caa7dca3e639d71c8697
-
SHA512
41ba2af4b6bfaa54d28e018f27977d96df306dc7194b55510cbed0d78e00b1cd98a61f82887a87b9e627b0b41e52cd1151a16faaa57f40990598dfd0547c173a
-
SSDEEP
1536:JeESt/basV2rcZhG6ySN7naopW1ZzWOIaEjrqMUs:JeESt/basVTgS7naow1ptXESb
Score
9/10
Malware Config
Signatures
-
Contacts a large (37879) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/d23c943cdb07744ec8d7cc82028966dd/tmp/d23c943cdb07744ec8d7cc82028966dd1⤵
-
/bin/shsh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /q���!���/tmp/d23c943cdb07744ec8d7cc82028966dd bin/systemd; chmod 777 bin/systemd "1⤵
-
/bin/rmrm -rf bin/systemd2⤵
-
-
/bin/mkdirmkdir bin2⤵
- Reads runtime system information
-
-
/bin/mvmv "/q���!���/tmp/d23c943cdb07744ec8d7cc82028966dd" bin/systemd2⤵
- Reads runtime system information
-
-
/bin/chmodchmod 777 "bin/systemd "2⤵
-