c9bd6d01eb7258fef88ec5c9276431c1db45f063b316f83943e45b6a40a76783

Resubmissions

20-04-2023 08:22

230420-j9pnpaae8s 10

20-04-2023 08:22

15-03-2023 12:40

15-03-2023 12:39

13-03-2023 14:43

24-08-2021 03:35

Analysis

max time kernel
0s
max time network
141s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13-03-2023 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nyynvefzjerks
Size

546KB
MD5

2a91a3170a5fd4fb3e30f3d63b9120de
SHA1

1a7a226833f43fdaee71cb6f84914f9a1e87de81
SHA256

c9bd6d01eb7258fef88ec5c9276431c1db45f063b316f83943e45b6a40a76783
SHA512

2d396f7fd0e661a2f15a1f0dc51341b89d9b28f6742a4bdfb7fe9115c5c7b44d9b8ac6e1c5e492f5971c2f9595f17c4154d979f7183df23d8f52ab0e24834d3f
SSDEEP

12288:D3P1A0+Kvdnd4Asvhc27/ao+PzENGtkZg0/CedRlZRqR6ysen:Dfm0+KlZsJc27io2zYGtk20/LdF0+8

Score

9^/10

persistence

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 38 IoCs

Hijack Execution Flow

T1574

Processes:

description	ioc
/bin/jxwlelbp	/bin/jxwlelbp
/bin/caxeksb	/bin/caxeksb
/bin/hvxqqhlhcjjle	/bin/hvxqqhlhcjjle
/bin/spzcukdkgmbngd	/bin/spzcukdkgmbngd
/bin/cmqzlvcj	/bin/cmqzlvcj
/bin/xizpxystjv	/bin/xizpxystjv
/bin/rczxwjurh	/bin/rczxwjurh
/bin/jxxcpphpq	/bin/jxxcpphpq
/bin/txoatzlfyuey	/bin/txoatzlfyuey
/bin/cqlnibdviibqs	/bin/cqlnibdviibqs
/bin/sgymejiu	/bin/sgymejiu
/bin/kalojvksrtwaiv	/bin/kalojvksrtwaiv
/bin/lkejviu	/bin/lkejviu
/bin/wnglek	/bin/wnglek
/bin/nocoaknwqnvoae	/bin/nocoaknwqnvoae
/bin/vuoqepgn	/bin/vuoqepgn
/bin/scsbxejbzfpfa	/bin/scsbxejbzfpfa
/bin/almsnftnleq	/bin/almsnftnleq
/bin/iqewfvllm	/bin/iqewfvllm
/bin/uicuerr	/bin/uicuerr
/bin/khrkgzgkbu	/bin/khrkgzgkbu
/bin/zulkxxkpbj	/bin/zulkxxkpbj
/bin/eoqlaed	/bin/eoqlaed
/bin/vlidvuo	/bin/vlidvuo
/bin/tejwei	/bin/tejwei
/bin/ldwpdog	/bin/ldwpdog
/bin/owirfs	/bin/owirfs
/bin/rjhhpljbm	/bin/rjhhpljbm
/bin/opnepnykytqqd	/bin/opnepnykytqqd
/bin/abzalqbwfbt	/bin/abzalqbwfbt
/bin/wstycivuv	/bin/wstycivuv
/bin/wxisbqncyjknab	/bin/wxisbqncyjknab
/bin/hudaozqlnswjw	/bin/hudaozqlnswjw
/bin/jyoumlyno	/bin/jyoumlyno
/bin/akfvehmpehse	/bin/akfvehmpehse
/bin/qvmbkucqpm	/bin/qvmbkucqpm
/bin/czbdgnfca	/bin/czbdgnfca
/bin/xjngsifl	/bin/xjngsifl

Modifies rc script 1 TTPs 5 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

Processes:

description	ioc
/etc/rc1.d/S90skrejzfevnyyn	/etc/rc1.d/S90skrejzfevnyyn
/etc/rc2.d/S90skrejzfevnyyn	/etc/rc2.d/S90skrejzfevnyyn
/etc/rc3.d/S90skrejzfevnyyn	/etc/rc3.d/S90skrejzfevnyyn
/etc/rc4.d/S90skrejzfevnyyn	/etc/rc4.d/S90skrejzfevnyyn
/etc/rc5.d/S90skrejzfevnyyn	/etc/rc5.d/S90skrejzfevnyyn

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

Processes:

description	ioc
/dev/shm/sem.QgnTiJ	/dev/shm/sem.QgnTiJ

/tmp/nyynvefzjerks
/tmp/nyynvefzjerks
1⤵
PID:576

/bin/wxisbqncyjknab
/bin/wxisbqncyjknab -d 578
1⤵
PID:582

/bin/cqlnibdviibqs
/bin/cqlnibdviibqs -d 578
1⤵
PID:585

/bin/vlidvuo
/bin/vlidvuo -d 578
1⤵
PID:592

/bin/uicuerr
/bin/uicuerr -d 578
1⤵
PID:595

/bin/qvmbkucqpm
/bin/qvmbkucqpm -d 578
1⤵
PID:598

/bin/scsbxejbzfpfa
/bin/scsbxejbzfpfa -d 578
1⤵
PID:601

/bin/hudaozqlnswjw
/bin/hudaozqlnswjw -d 578
1⤵
PID:604

/bin/almsnftnleq
/bin/almsnftnleq -d 578
1⤵
PID:607

/bin/khrkgzgkbu
/bin/khrkgzgkbu -d 578
1⤵
PID:610

/bin/sgymejiu
/bin/sgymejiu -d 578
1⤵
PID:613

/bin/czbdgnfca
/bin/czbdgnfca -d 578
1⤵
PID:616

/bin/kalojvksrtwaiv
/bin/kalojvksrtwaiv -d 578
1⤵
PID:619

/bin/jyoumlyno
/bin/jyoumlyno -d 578
1⤵
PID:622

/bin/tejwei
/bin/tejwei -d 578
1⤵
PID:625

/bin/hvxqqhlhcjjle
/bin/hvxqqhlhcjjle -d 578
1⤵
PID:628

/bin/xjngsifl
/bin/xjngsifl -d 578
1⤵
PID:631

/bin/owirfs
/bin/owirfs -d 578
1⤵
PID:634

/bin/ldwpdog
/bin/ldwpdog -d 578
1⤵
PID:637

/bin/cmqzlvcj
/bin/cmqzlvcj -d 578
1⤵
PID:640

/bin/spzcukdkgmbngd
/bin/spzcukdkgmbngd -d 578
1⤵
PID:643

/bin/xizpxystjv
/bin/xizpxystjv -d 578
1⤵
PID:646

/bin/rjhhpljbm
/bin/rjhhpljbm -d 578
1⤵
PID:649

/bin/rczxwjurh
/bin/rczxwjurh -d 578
1⤵
PID:652

/bin/opnepnykytqqd
/bin/opnepnykytqqd -d 578
1⤵
PID:655

/bin/zulkxxkpbj
/bin/zulkxxkpbj -d 578
1⤵
PID:658

/bin/iqewfvllm
/bin/iqewfvllm -d 578
1⤵
PID:661

/bin/jxxcpphpq
/bin/jxxcpphpq -d 578
1⤵
PID:664

/bin/abzalqbwfbt
/bin/abzalqbwfbt -d 578
1⤵
PID:667

/bin/txoatzlfyuey
/bin/txoatzlfyuey -d 578
1⤵
PID:670

/bin/wnglek
/bin/wnglek -d 578
1⤵
PID:673

/bin/nocoaknwqnvoae
/bin/nocoaknwqnvoae -d 578
1⤵
PID:676

/bin/eoqlaed
/bin/eoqlaed -d 578
1⤵
PID:679

/bin/vuoqepgn
/bin/vuoqepgn -d 578
1⤵
PID:682

/bin/wstycivuv
/bin/wstycivuv -d 578
1⤵
PID:685

/bin/jxwlelbp
/bin/jxwlelbp -d 578
1⤵
PID:688

/bin/caxeksb
/bin/caxeksb -d 578
1⤵
PID:691

/bin/lkejviu
/bin/lkejviu -d 578
1⤵
PID:694

/bin/akfvehmpehse
/bin/akfvehmpehse -d 578
1⤵
PID:697

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads