44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c

Resubmissions

20/04/2023, 08:22

230420-j9m5vsge7210

20/04/2023, 08:22

18/04/2023, 12:06

06/04/2023, 23:21

21/03/2023, 12:03

15/03/2023, 16:56

25/11/2022, 09:55

Analysis

max time kernel
0s
max time network
50s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
21/03/2023, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
Size 611KB
Sample230321-n8hafaab63
SHA256 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
MD5 bc57b23aa694336f34ce91037c97b196
SHA1 001a8484c9cc0ba429646cf4c7fcf9815a29b6cf
SHA512 d178e8c8db4a63ab88301a2fc2dd1ea2444fd508a8c80ac3a9b0109f43c6e00781a84415a6955028fe39dbe310b6950f7971e7258c03912586f980d04a88714c
SSDEEP 12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrrLT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNLBVEBl/91h
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 5 IoCs

Hijack Execution Flow

T1574

description	ioc
/bin/tolbhulnvo	/bin/tolbhulnvo
/bin/yljydkevjy	/bin/yljydkevjy
/bin/shastoxnih	/bin/shastoxnih
/bin/mfhhzecrbs	/bin/mfhhzecrbs
/bin/kopbyfqsnm	/bin/kopbyfqsnm

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task

T1053

description	ioc	Process
/etc/crontab	/etc/crontab	sed
/etc/crontab	/etc/crontab	sh

Modifies rc script 1 TTPs 12 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
/etc/rc2.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc2.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc1.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc1.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc3.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc3.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc4.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc4.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc5.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc5.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d

Write file to user bin folder 1 TTPs 7 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d
/usr/bin/shastoxnih	/usr/bin/shastoxnih	Process not Found
/usr/bin/mfhhzecrbs	/usr/bin/mfhhzecrbs	Process not Found
/usr/bin/kopbyfqsnm	/usr/bin/kopbyfqsnm	Process not Found
/usr/bin/tolbhulnvo	/usr/bin/tolbhulnvo	Process not Found
/usr/bin/yljydkevjy	/usr/bin/yljydkevjy	Process not Found
/usr/bin/vnsjsnktbj	/usr/bin/vnsjsnktbj	Process not Found

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	systemctl
/proc/self/stat	/proc/self/stat	systemctl
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl
/proc/1/environ	/proc/1/environ	systemctl
/proc/1/sched	/proc/1/sched	systemctl
/proc/cmdline	/proc/cmdline	systemctl

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
/tmp/shastoxnih	/tmp/shastoxnih
/tmp/mfhhzecrbs	/tmp/mfhhzecrbs
/tmp/kopbyfqsnm	/tmp/kopbyfqsnm
/tmp/tolbhulnvo	/tmp/tolbhulnvo

/tmp/44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
/tmp/44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:612

/bin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:615

/sbin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:615

/usr/bin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:615

/usr/sbin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:615

/usr/local/bin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:615

/usr/local/sbin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:615

/usr/X11R6/bin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:615

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:618
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:619

/bin/update-rc.d
update-rc.d 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c defaults
1⤵
PID:617

/sbin/update-rc.d
update-rc.d 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c defaults
1⤵
PID:617

/usr/bin/update-rc.d
update-rc.d 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c defaults
1⤵
PID:617

/usr/sbin/update-rc.d
update-rc.d 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c defaults
1⤵
- Modifies rc script
- Write file to user bin folder
PID:617
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:624

/usr/bin/shastoxnih
/usr/bin/shastoxnih "ifconfig eth0" 613
1⤵
PID:643

/usr/bin/shastoxnih
/usr/bin/shastoxnih su 613
1⤵
PID:647

/usr/bin/shastoxnih
/usr/bin/shastoxnih id 613
1⤵
PID:650

/usr/bin/shastoxnih
/usr/bin/shastoxnih top 613
1⤵
PID:653

/usr/bin/shastoxnih
/usr/bin/shastoxnih "ps -ef" 613
1⤵
PID:656

/usr/bin/mfhhzecrbs
/usr/bin/mfhhzecrbs "echo \"find\"" 613
1⤵
PID:674

/usr/bin/mfhhzecrbs
/usr/bin/mfhhzecrbs "cd /etc" 613
1⤵
PID:677

/usr/bin/mfhhzecrbs
/usr/bin/mfhhzecrbs top 613
1⤵
PID:680

/usr/bin/mfhhzecrbs
/usr/bin/mfhhzecrbs "netstat -an" 613
1⤵
PID:683

/usr/bin/mfhhzecrbs
/usr/bin/mfhhzecrbs "sleep 1" 613
1⤵
PID:686

/usr/bin/kopbyfqsnm
/usr/bin/kopbyfqsnm ls 613
1⤵
PID:689

/usr/bin/kopbyfqsnm
/usr/bin/kopbyfqsnm sh 613
1⤵
PID:692

/usr/bin/kopbyfqsnm
/usr/bin/kopbyfqsnm id 613
1⤵
PID:695

/usr/bin/kopbyfqsnm
/usr/bin/kopbyfqsnm uptime 613
1⤵
PID:698

/usr/bin/kopbyfqsnm
/usr/bin/kopbyfqsnm whoami 613
1⤵
PID:701

/usr/bin/tolbhulnvo
/usr/bin/tolbhulnvo "grep \"A\"" 613
1⤵
PID:704

/usr/bin/tolbhulnvo
/usr/bin/tolbhulnvo bash 613
1⤵
PID:707

/usr/bin/tolbhulnvo
/usr/bin/tolbhulnvo "ifconfig eth0" 613
1⤵
PID:710

/usr/bin/tolbhulnvo
/usr/bin/tolbhulnvo "route -n" 613
1⤵
PID:713

/usr/bin/tolbhulnvo
/usr/bin/tolbhulnvo "sleep 1" 613
1⤵
PID:716

/usr/bin/yljydkevjy
/usr/bin/yljydkevjy "ps -ef" 613
1⤵
PID:719

/usr/bin/yljydkevjy
/usr/bin/yljydkevjy pwd 613
1⤵
PID:722

/usr/bin/yljydkevjy
/usr/bin/yljydkevjy "ifconfig eth0" 613
1⤵
PID:725

/usr/bin/yljydkevjy
/usr/bin/yljydkevjy uptime 613
1⤵
PID:728

/usr/bin/yljydkevjy
/usr/bin/yljydkevjy "route -n" 613
1⤵
PID:731

/usr/bin/vnsjsnktbj
/usr/bin/vnsjsnktbj "echo \"find\"" 613
1⤵
PID:734

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task

T1053

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads