Overview

overview

10

Static

static

10

123.exe

windows7-x64

1

123.exe

windows10-2004-x64

1

360sb.exe

windows7-x64

10

360sb.exe

windows10-2004-x64

10

7000.32

ubuntu-18.04-amd64

1

7000.64

ubuntu-18.04-amd64

7

Linux577

ubuntu-18.04-amd64

8

Mh.exe

windows7-x64

7

Mh.exe

windows10-2004-x64

10

Mh1.exe

windows7-x64

7

Mh1.exe

windows10-2004-x64

10

Mh2.exe

windows7-x64

7

Mh2.exe

windows10-2004-x64

10

SETUP.exe

windows7-x64

SETUP.exe

windows10-2004-x64

TX98

ubuntu-18.04-amd64

1

TX981

ubuntu-18.04-amd64

1

TX982

ubuntu-18.04-amd64

7

TX984

debian-9-armhf

7

TX985

debian-9-mipsel

7

TX986

debian-9-mips

7

bjyk.exe

windows7-x64

10

bjyk.exe

windows10-2004-x64

10

ceshi.exe

windows7-x64

10

ceshi.exe

windows10-2004-x64

10

ddos.exe

windows7-x64

1

ddos.exe

windows10-2004-x64

10

dhl.exe

windows7-x64

7

dhl.exe

windows10-2004-x64

10

mh3.exe

windows7-x64

7

mh3.exe

windows10-2004-x64

10

server.exe

windows7-x64

10

Analysis

  • max time kernel
    11721s
  • max time network
    156s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20221111-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20221111-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    27-03-2023 09:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TX986

  • Size

    1.1MB

  • MD5

    8adfc3cc5e225440684e74b7f7994933

  • SHA1

    fbc72c5bc436a7565d994886e238b80731e373b8

  • SHA256

    746fd8e299a5542658c051d08765f327f3c3e48248698a29cf57f151a282b157

  • SHA512

    e9dda159470640c11a6832f8d6be355d90b32c9c1fa7b938b47fc37fdeb459ccb17a8edeed8e0c065f107c7b04eed4b8dea5290543564a7732d3ae8c4c57acfa

  • SSDEEP

    24576:qsFkPsgRseqq7s7L23vHkF/CZ5lfwNjcpzdmMqMSjG2oedCp/mpyS1tFhextK:leLsL23vEF/CZ5lfwNjcpzdmMqMSjG2F

Score
7/10
persistence

Malware Config

Signatures

  • Modifies init.d 1 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 1 TTPs 4 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 7 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/TX986
    /tmp/TX986
    1⤵
      PID:327
      • /bin/sh
        sh -c "sed -i -e '/exit/d' /etc/rc.local"
        2⤵
          PID:328
          • /bin/sed
            sed -i -e /exit/d /etc/rc.local
            3⤵
            • Modifies rc script
            • Reads runtime system information
            PID:329
        • /bin/sh
          sh -c "sed -i -e '/^ | | \$/d' /etc/rc.local"
          2⤵
            PID:330
            • /bin/sed
              sed -i -e "/^ | | \$/d" /etc/rc.local
              3⤵
              • Reads runtime system information
              PID:331
          • /bin/sh
            sh -c "sed -i -e '/TX986 reboot/d' /etc/rc.local"
            2⤵
              PID:332
              • /bin/sed
                sed -i -e "/TX986 reboot/d" /etc/rc.local
                3⤵
                • Modifies rc script
                • Reads runtime system information
                PID:333
            • /bin/sh
              sh -c "sed -i -e '2 i/tmp/TX986 reboot' /etc/rc.local"
              2⤵
                PID:335
                • /bin/sed
                  sed -i -e "2 i/tmp/TX986 reboot" /etc/rc.local
                  3⤵
                  • Modifies rc script
                  • Reads runtime system information
                  PID:339
              • /bin/sh
                sh -c "sed -i -e '2 i/tmp/TX986 reboot start' /etc/rc.d/rc.local"
                2⤵
                  PID:340
                  • /bin/sed
                    sed -i -e "2 i/tmp/TX986 reboot start" /etc/rc.d/rc.local
                    3⤵
                    • Modifies rc script
                    • Reads runtime system information
                    PID:341
                • /bin/sh
                  sh -c "sed -i -e '2 i/tmp/TX986 reboot start' /etc/init.d/boot.local"
                  2⤵
                    PID:342
                    • /bin/sed
                      sed -i -e "2 i/tmp/TX986 reboot start" /etc/init.d/boot.local
                      3⤵
                      • Modifies init.d
                      • Reads runtime system information
                      PID:343

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Initial Access

                Execution

                Persistence

                Boot or Logon Autostart Execution

                2
                T1547

                Privilege Escalation

                Boot or Logon Autostart Execution

                2
                T1547

                Defense Evasion

                Credential Access

                Discovery

                System Information Discovery

                1
                T1082

                System Network Configuration Discovery

                1
                T1016

                Lateral Movement

                Collection

                Exfiltration

                Command and Control

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads