Analysis

  • max time kernel
    40926s
  • max time network
    160s
  • platform
    linux_mipsel
  • resource
    debian9-mipsel-en-20211208
  • resource tags

    arch:mipselimage:debian9-mipsel-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    27-03-2023 09:42

General

  • Target

    TX985

  • Size

    1.1MB

  • MD5

    5ab68ecc6f6262c76fc1875972a508dd

  • SHA1

    dac088cc4ef5377efcf81a325c8516e71a792672

  • SHA256

    aff22363942228229a1b40a4581f5e0593714d553ed5f2ea7aae15612b28142f

  • SHA512

    e0837b8ec1632bc3493d79236dba2bca402f1d77e5ad9814c5df6f8b59115f69b71189a8d345df0ad32ed01e78ac3d151741643669ddc23595d9f74b7b7731d3

  • SSDEEP

    12288:v0gZjw/mGyri7g8Nyllxm+KYCy1aPrfWf47b/d+qdeaQklaHhmM7tL+GSPlXJZru:VETLPAFHcMJ6l5ZZVt6Ai3YKhAxtK

Score
7/10

Malware Config

Signatures

  • Modifies init.d 1 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

  • Modifies rc script 1 TTPs 4 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 7 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/TX985
    /tmp/TX985
    1⤵
      PID:331
      • /bin/sh
        sh -c "sed -i -e '/exit/d' /etc/rc.local"
        2⤵
          PID:332
          • /bin/sed
            sed -i -e /exit/d /etc/rc.local
            3⤵
            • Modifies rc script
            • Reads runtime system information
            PID:333
        • /bin/sh
          sh -c "sed -i -e '/^ | | \$/d' /etc/rc.local"
          2⤵
            PID:334
            • /bin/sed
              sed -i -e "/^ | | \$/d" /etc/rc.local
              3⤵
              • Reads runtime system information
              PID:335
          • /bin/sh
            sh -c "sed -i -e '/TX985 reboot/d' /etc/rc.local"
            2⤵
              PID:337
              • /bin/sed
                sed -i -e "/TX985 reboot/d" /etc/rc.local
                3⤵
                • Modifies rc script
                • Reads runtime system information
                PID:341
            • /bin/sh
              sh -c "sed -i -e '2 i/tmp/TX985 reboot' /etc/rc.local"
              2⤵
                PID:342
                • /bin/sed
                  sed -i -e "2 i/tmp/TX985 reboot" /etc/rc.local
                  3⤵
                  • Modifies rc script
                  • Reads runtime system information
                  PID:343
              • /bin/sh
                sh -c "sed -i -e '2 i/tmp/TX985 reboot start' /etc/rc.d/rc.local"
                2⤵
                  PID:344
                  • /bin/sed
                    sed -i -e "2 i/tmp/TX985 reboot start" /etc/rc.d/rc.local
                    3⤵
                    • Modifies rc script
                    • Reads runtime system information
                    PID:345
                • /bin/sh
                  sh -c "sed -i -e '2 i/tmp/TX985 reboot start' /etc/init.d/boot.local"
                  2⤵
                    PID:346
                    • /bin/sed
                      sed -i -e "2 i/tmp/TX985 reboot start" /etc/init.d/boot.local
                      3⤵
                      • Modifies init.d
                      • Reads runtime system information
                      PID:347

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Persistence

                Boot or Logon Autostart Execution

                2
                T1547

                Privilege Escalation

                Boot or Logon Autostart Execution

                2
                T1547

                Discovery

                System Information Discovery

                1
                T1082

                System Network Configuration Discovery

                1
                T1016

                Replay Monitor

                Loading Replay Monitor...

                Downloads