c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099 | Triage

Analysis

max time kernel
40927s
max time network
103s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
27-03-2023 09:33

Sharing

Report Analysis Logs

General

Target

Drkv
Size

1.2MB
MD5

3df5c5e26e2d9fd4946c8121299cd513
SHA1

efaa2e397773a5eda58a68ddce1d9e17a90fdbd3
SHA256

a17ca067bd6f74817a0516e6083c0739fc9b9e36aafd95b74fddc84343972cda
SHA512

9574af57a2984065c6c348f7242533211051c5e9e03c74d6926023c64f61805b4d28698a3c77c3c33ffe33b84f0224f308889a5071bfeca3557fd58043dcca78
SSDEEP

24576:e845rGHu6gVJKG75oFpA0VWeX4q2y1q2rJp0:745vRVJKGtSA0VWeoJu9p0

Score

9^/10

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 4 IoCs

Hijack Execution Flow
T1574

Processes:

cpcpcpcp

description ioc process

/bin/ps /bin/ps cp
/bin/ps /bin/ps cp
/bin/ss /bin/ss cp
/bin/ss /bin/ss cp

Write file to user bin folder 1 TTPs 12 IoCs

Hijack Execution Flow

Processes:

cpcpcpcpcpcpcpcp

description	ioc	process
/usr/bin/dpkgd/ss	/usr/bin/dpkgd/ss	cp
/usr/bin/bsd-port/getty	/usr/bin/bsd-port/getty	cp
/usr/bin/lsof	/usr/bin/lsof	cp
/usr/bin/bsd-port/getty	/usr/bin/bsd-port/getty	cp
/usr/bin/bsd-port/update_temporary	/usr/bin/bsd-port/update_temporary
/usr/bin/bsd-port/getty	/usr/bin/bsd-port/getty	cp
/usr/bin/bsd-port/getty	/usr/bin/bsd-port/getty	cp
/usr/bin/.sshd	/usr/bin/.sshd	cp
/usr/bin/dpkgd/ps	/usr/bin/dpkgd/ps	cp
/usr/bin/dpkgd/lsof	/usr/bin/dpkgd/lsof	cp
/usr/bin/lsof	/usr/bin/lsof	cp
/usr/bin/bsd-port/udevd.lock	/usr/bin/bsd-port/udevd.lock

Reads runtime system information 21 IoCs

Reads data from /proc virtual filesystem.

Processes:

cpmkdircpmkdirmkdirmkdirmkdirmkdircpmkdircpinsmodinsmodmkdircpmkdircpmkdircpmkdircp

description	ioc	process
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	cp
/proc/cmdline	/proc/cmdline	insmod
/proc/cmdline	/proc/cmdline	insmod
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	cp

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

Processes:

cpcp

description	ioc
/tmp/bill.lock	/tmp/bill.lock
/tmp/Drkv	/tmp/Drkv	cp
/tmp/Drkv	/tmp/Drkv	cp
/tmp/notify.file	/tmp/notify.file
/tmp/update_temporary	/tmp/update_temporary

/tmp/Drkv
/tmp/Drkv
1⤵
PID:576

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
1⤵
PID:582

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
2⤵
PID:583

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
1⤵
PID:584

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
2⤵
PID:585

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
1⤵
PID:586

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
2⤵
PID:587

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
1⤵
PID:588

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
2⤵
PID:589

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
1⤵
PID:590

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
2⤵
PID:591

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:592

/bin/mkdir
mkdir -p /usr/bin/bsd-port
2⤵
- Reads runtime system information
PID:593

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:594

/bin/mkdir
mkdir -p /usr/bin/bsd-port
2⤵
- Reads runtime system information
PID:595

/bin/sh
sh -c "cp -f /tmp/Drkv /usr/bin/bsd-port/getty"
1⤵
PID:596

/bin/cp
cp -f /tmp/Drkv /usr/bin/bsd-port/getty
2⤵
- Write file to user bin folder
- Reads runtime system information
- Writes file to tmp directory
PID:597

/bin/sh
sh -c /usr/bin/bsd-port/getty
1⤵
PID:599

/usr/bin/bsd-port/getty
/usr/bin/bsd-port/getty
2⤵
PID:600

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:602

/bin/mkdir
mkdir -p /usr/bin
2⤵
- Reads runtime system information
PID:603

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:604

/bin/mkdir
mkdir -p /usr/bin
2⤵
- Reads runtime system information
PID:605

/bin/sh
sh -c "cp -f /tmp/Drkv /usr/bin/.sshd"
1⤵
PID:606

/bin/cp
cp -f /tmp/Drkv /usr/bin/.sshd
2⤵
- Write file to user bin folder
- Reads runtime system information
- Writes file to tmp directory
PID:607

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
1⤵
PID:608

/bin/ln
ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
2⤵
PID:609

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
1⤵
PID:610

/bin/ln
ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
2⤵
PID:611

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
1⤵
PID:612

/bin/ln
ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
2⤵
PID:613

/bin/sh
sh -c /usr/bin/.sshd
1⤵
PID:616

/usr/bin/.sshd
/usr/bin/.sshd
2⤵
PID:617

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
1⤵
PID:614

/bin/ln
ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
2⤵
PID:618

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
1⤵
PID:619

/bin/ln
ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
2⤵
PID:620

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
1⤵
PID:621

/bin/mkdir
mkdir -p /usr/bin/dpkgd
2⤵
- Reads runtime system information
PID:622

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
1⤵
PID:623

/bin/cp
cp -f /bin/ps /usr/bin/dpkgd/ps
2⤵
- Writes file to system bin folder
- Write file to user bin folder
- Reads runtime system information
PID:624

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:625

/bin/mkdir
mkdir -p /bin
2⤵
- Reads runtime system information
PID:626

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:627

/bin/mkdir
mkdir -p /bin
2⤵
- Reads runtime system information
PID:628

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
1⤵
PID:629

/bin/cp
cp -f /usr/bin/bsd-port/getty /bin/ps
2⤵
- Writes file to system bin folder
- Write file to user bin folder
- Reads runtime system information
PID:630

/bin/sh
sh -c "chmod 0755 /bin/ps"
1⤵
PID:631

/bin/chmod
chmod 0755 /bin/ps
2⤵
PID:632

/bin/sh
sh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"
1⤵
PID:633

/bin/cp
cp -f /bin/ss /usr/bin/dpkgd/ss
2⤵
- Writes file to system bin folder
- Write file to user bin folder
- Reads runtime system information
PID:634

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:635

/bin/mkdir
mkdir -p /bin
2⤵
- Reads runtime system information
PID:636

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:637

/bin/mkdir
mkdir -p /bin
2⤵
- Reads runtime system information
PID:638

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"
1⤵
PID:639

/bin/cp
cp -f /usr/bin/bsd-port/getty /bin/ss
2⤵
- Writes file to system bin folder
- Write file to user bin folder
- Reads runtime system information
PID:640

/bin/sh
sh -c "chmod 0755 /bin/ss"
1⤵
PID:641

/bin/chmod
chmod 0755 /bin/ss
2⤵
PID:642

/bin/sh
sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
1⤵
PID:643

/bin/cp
cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:644

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:645

/bin/mkdir
mkdir -p /usr/bin
2⤵
- Reads runtime system information
PID:646

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:647

/bin/mkdir
mkdir -p /usr/bin
2⤵
- Reads runtime system information
PID:648

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
1⤵
PID:649

/bin/cp
cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:650

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
1⤵
PID:651

/bin/chmod
chmod 0755 /usr/bin/lsof
2⤵
PID:652

/bin/sh
sh -c "insmod /usr/bin/bsd-port/xpacket.ko"
1⤵
PID:655

/sbin/insmod
insmod /usr/bin/bsd-port/xpacket.ko
2⤵
- Reads runtime system information
PID:657

/bin/sh
sh -c "insmod /tmp/xpacket.ko"
1⤵
PID:656

/sbin/insmod
insmod /tmp/xpacket.ko
2⤵
- Reads runtime system information
PID:658

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...