d8598974b224617546317affb3a80e98532799508bf12cc7e0d80087f9274256

Resubmissions

23/03/2023, 02:11

230323-cmk9esda24 7

23/03/2023, 02:05

230323-ch3ynsch79 7

Analysis

max time kernel
11347s
max time network
453s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
23/03/2023, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

o11
Size

6.2MB
MD5

aa266a8d811e5c408e544431da5b0707
SHA1

b924ccaaf3e66daacf66601b73a380e2e80ad3d4
SHA256

d8598974b224617546317affb3a80e98532799508bf12cc7e0d80087f9274256
SHA512

92b1e387de2a2324b29df83d2c70d263289ba56cb2cd2508b67bcd899221a331effd8f8a4f3342d011378e1a2e57d12a219c298c64d19a6186a929b64f64cbdd
SSDEEP

98304:6jehM1o3D40qejPluoFDH4XgLiBDF4WK1L7pq95hhTjUc0CwhtsYrzBM5aciSn:eehco3D4m3FDKTKppqdhTjUcbYhiatSn

Score

5^/10

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	o11

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/self/exe	/proc/self/exe	o11
/proc/sys/net/core/somaxconn	/proc/sys/net/core/somaxconn	Process not Found

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/o11	/tmp/o11	o11

/tmp/o11
/tmp/o11
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:595

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads