44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c

Resubmissions

20/04/2023, 08:22

230420-j9m5vsge7210

20/04/2023, 08:22

18/04/2023, 12:06

06/04/2023, 23:21

21/03/2023, 12:03

15/03/2023, 16:56

25/11/2022, 09:55

Analysis

max time kernel
0s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
15/03/2023, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
Size 611KB
Sample230315-vftlbsec99
SHA256 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
MD5 bc57b23aa694336f34ce91037c97b196
SHA1 001a8484c9cc0ba429646cf4c7fcf9815a29b6cf
SHA512 d178e8c8db4a63ab88301a2fc2dd1ea2444fd508a8c80ac3a9b0109f43c6e00781a84415a6955028fe39dbe310b6950f7971e7258c03912586f980d04a88714c
SSDEEP 12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrrLT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNLBVEBl/91h
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 5 IoCs

Hijack Execution Flow

T1574

description	ioc
/bin/oespztzgth	/bin/oespztzgth
/bin/tuwdlcjgur	/bin/tuwdlcjgur
/bin/smzdsbznbs	/bin/smzdsbznbs
/bin/kmqsnkaxlk	/bin/kmqsnkaxlk
/bin/xgusbmwlki	/bin/xgusbmwlki

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task

T1053

description	ioc	Process
/etc/crontab	/etc/crontab	sed
/etc/crontab	/etc/crontab	sh

Modifies rc script 1 TTPs 12 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d
/etc/rc3.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc3.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc4.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc4.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc5.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc5.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc1.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc1.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc2.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc2.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc0.d/	/etc/rc0.d/	update-rc.d

Write file to user bin folder 1 TTPs 8 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
/usr/bin/oespztzgth	/usr/bin/oespztzgth	Process not Found
/usr/bin/dcxeuzskfz	/usr/bin/dcxeuzskfz	Process not Found
/usr/bin/tuwdlcjgur	/usr/bin/tuwdlcjgur	Process not Found
/usr/bin/smzdsbznbs	/usr/bin/smzdsbznbs	Process not Found
/usr/bin/kmqsnkaxlk	/usr/bin/kmqsnkaxlk	Process not Found
/usr/bin/xgusbmwlki	/usr/bin/xgusbmwlki	Process not Found
/usr/bin/kowoghitsb	/usr/bin/kowoghitsb	Process not Found
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/cmdline	/proc/cmdline	systemctl
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	systemctl
/proc/self/stat	/proc/self/stat	systemctl
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl
/proc/1/environ	/proc/1/environ	systemctl
/proc/1/sched	/proc/1/sched	systemctl

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
/tmp/tuwdlcjgur	/tmp/tuwdlcjgur
/tmp/smzdsbznbs	/tmp/smzdsbznbs
/tmp/kmqsnkaxlk	/tmp/kmqsnkaxlk
/tmp/xgusbmwlki	/tmp/xgusbmwlki
/tmp/oespztzgth	/tmp/oespztzgth

/tmp/44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
/tmp/44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:600

/bin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:603

/sbin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:603

/usr/bin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:603

/usr/sbin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:603

/usr/local/bin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:603

/usr/local/sbin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:603

/usr/X11R6/bin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:603

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:606
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:607

/bin/update-rc.d
update-rc.d 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c defaults
1⤵
PID:605

/sbin/update-rc.d
update-rc.d 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c defaults
1⤵
PID:605

/usr/bin/update-rc.d
update-rc.d 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c defaults
1⤵
PID:605

/usr/sbin/update-rc.d
update-rc.d 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c defaults
1⤵
- Modifies rc script
- Write file to user bin folder
PID:605
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:611

/usr/bin/dcxeuzskfz
/usr/bin/dcxeuzskfz id 601
1⤵
PID:632

/usr/bin/dcxeuzskfz
/usr/bin/dcxeuzskfz "ps -ef" 601
1⤵
PID:635

/usr/bin/dcxeuzskfz
/usr/bin/dcxeuzskfz "ifconfig eth0" 601
1⤵
PID:638

/usr/bin/dcxeuzskfz
/usr/bin/dcxeuzskfz "route -n" 601
1⤵
PID:641

/usr/bin/dcxeuzskfz
/usr/bin/dcxeuzskfz "ifconfig eth0" 601
1⤵
PID:644

/usr/bin/tuwdlcjgur
/usr/bin/tuwdlcjgur id 601
1⤵
PID:647

/usr/bin/tuwdlcjgur
/usr/bin/tuwdlcjgur sh 601
1⤵
PID:650

/usr/bin/tuwdlcjgur
/usr/bin/tuwdlcjgur "grep \"A\"" 601
1⤵
PID:653

/usr/bin/tuwdlcjgur
/usr/bin/tuwdlcjgur top 601
1⤵
PID:656

/usr/bin/tuwdlcjgur
/usr/bin/tuwdlcjgur "grep \"A\"" 601
1⤵
PID:659

/usr/bin/smzdsbznbs
/usr/bin/smzdsbznbs "sleep 1" 601
1⤵
PID:662

/usr/bin/smzdsbznbs
/usr/bin/smzdsbznbs "echo \"find\"" 601
1⤵
PID:665

/usr/bin/smzdsbznbs
/usr/bin/smzdsbznbs pwd 601
1⤵
PID:668

/usr/bin/smzdsbznbs
/usr/bin/smzdsbznbs "cd /etc" 601
1⤵
PID:671

/usr/bin/smzdsbznbs
/usr/bin/smzdsbznbs "route -n" 601
1⤵
PID:674

/usr/bin/kmqsnkaxlk
/usr/bin/kmqsnkaxlk id 601
1⤵
PID:677

/usr/bin/kmqsnkaxlk
/usr/bin/kmqsnkaxlk top 601
1⤵
PID:680

/usr/bin/kmqsnkaxlk
/usr/bin/kmqsnkaxlk id 601
1⤵
PID:683

/usr/bin/kmqsnkaxlk
/usr/bin/kmqsnkaxlk top 601
1⤵
PID:686

/usr/bin/kmqsnkaxlk
/usr/bin/kmqsnkaxlk uptime 601
1⤵
PID:689

/usr/bin/xgusbmwlki
/usr/bin/xgusbmwlki sh 601
1⤵
PID:692

/usr/bin/xgusbmwlki
/usr/bin/xgusbmwlki bash 601
1⤵
PID:695

/usr/bin/xgusbmwlki
/usr/bin/xgusbmwlki "cat resolv.conf" 601
1⤵
PID:698

/usr/bin/xgusbmwlki
/usr/bin/xgusbmwlki pwd 601
1⤵
PID:701

/usr/bin/xgusbmwlki
/usr/bin/xgusbmwlki who 601
1⤵
PID:704

/usr/bin/kowoghitsb
/usr/bin/kowoghitsb ls 601
1⤵
PID:707

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task

T1053

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads