438e44aae94e8376d2e36e23212920e936b7517bca24eaf66e9d7d014e21552c

Analysis

max time kernel
11719s
max time network
133s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
27-03-2023 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Linux577
Size

474KB
MD5

9e96170c07c1566ac0d9d7b93e7928d1
SHA1

f762afafa8bf6b694bdc0bf00d8b4caa38d96ddc
SHA256

825cbeae503c8d9f4ff8a55d14042e83db220f4ed428e57b57fc48335d09f359
SHA512

e042b528351ad9f32fe37d60bc2b45bb7b7b2cc60c59a10e8eee00a4417c53afa55803f0e9e1196aad912f0b881cfe627dad38802181a0d447b80985344cbd55
SSDEEP

12288:Cd3IH4kbsBnbOXzFOS4NhgvMfA5z5m9NO554UA+:Cd4H4/OCI16O55h

Score

8^/10

persistence

Malware Config

Signatures

Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.

Dynamic Resolution
T1568

Processes:

rm

description ioc process

/etc/resolv.conf /etc/resolv.conf rm
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task
T1053

Processes:

sed

description ioc process

/etc/crontab /etc/crontab sed
Modifies init.d 1 TTPs 2 IoCs
Adds/modifies system service, likely for persistence.
persistence

Boot or Logon Autostart Execution
T1547

Processes:

update-rc.d

description ioc

/etc/init.d/Linux577 /etc/init.d/Linux577
/etc/init.d/.chinaz{1679910169 /etc/init.d/.chinaz{1679910169 update-rc.d

description	ioc	process
/etc/resolv.conf	/etc/resolv.conf	rm

description	ioc	process
/etc/crontab	/etc/crontab	sed

description	ioc
/etc/init.d/Linux577	/etc/init.d/Linux577
/etc/init.d/.chinaz{1679910169	/etc/init.d/.chinaz{1679910169	update-rc.d

Modifies rc script 1 TTPs 24 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

Processes:

update-rc.dupdate-rc.d

description	ioc
/etc/rc1.d/S90Linux577	/etc/rc1.d/S90Linux577
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d
/etc/rc3.d/S90Linux577	/etc/rc3.d/S90Linux577
/etc/rc4.d/S90Linux577	/etc/rc4.d/S90Linux577
/etc/rc2.d/S90.chinaz{1679910169	/etc/rc2.d/S90.chinaz{1679910169
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc2.d/S90Linux577	/etc/rc2.d/S90Linux577
/etc/rc5.d/S90Linux577	/etc/rc5.d/S90Linux577
/etc/rc1.d/S90.chinaz{1679910169	/etc/rc1.d/S90.chinaz{1679910169
/etc/rc3.d/S90.chinaz{1679910169	/etc/rc3.d/S90.chinaz{1679910169
/etc/rc5.d/S90.chinaz{1679910169	/etc/rc5.d/S90.chinaz{1679910169
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d
/etc/rc4.d/S90.chinaz{1679910169	/etc/rc4.d/S90.chinaz{1679910169
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc6.d/	/etc/rc6.d/	update-rc.d

Write file to user bin folder 1 TTPs 2 IoCs

Hijack Execution Flow
T1574

Processes:

update-rc.dupdate-rc.d

description ioc process

/usr/sbin/update-rc.d /usr/sbin/update-rc.d update-rc.d
/usr/sbin/update-rc.d /usr/sbin/update-rc.d update-rc.d

description	ioc	process
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d

Reads runtime system information 13 IoCs

Reads data from /proc virtual filesystem.

Processes:

sedsystemctlsystemctl

description	ioc	process
/proc/filesystems	/proc/filesystems	sed
/proc/self/stat	/proc/self/stat	systemctl
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl
/proc/filesystems	/proc/filesystems	systemctl
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl
/proc/cmdline	/proc/cmdline	systemctl
/proc/filesystems	/proc/filesystems	systemctl
/proc/1/environ	/proc/1/environ	systemctl
/proc/1/sched	/proc/1/sched	systemctl
/proc/cmdline	/proc/cmdline	systemctl
/proc/self/stat	/proc/self/stat	systemctl
/proc/1/environ	/proc/1/environ	systemctl
/proc/1/sched	/proc/1/sched	systemctl

Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.

Processes:

touch

description ioc

/tmp/Linux577 /tmp/Linux577
/tmp/ConfigDatecz /tmp/ConfigDatecz touch

description	ioc
/tmp/Linux577	/tmp/Linux577
/tmp/ConfigDatecz	/tmp/ConfigDatecz	touch

/tmp/Linux577
/tmp/Linux577
1⤵
PID:617

/usr/local/sbin/chkconfig
chkconfig --del Linux577
1⤵
PID:660

/usr/local/bin/chkconfig
chkconfig --del Linux577
1⤵
PID:660

/usr/sbin/chkconfig
chkconfig --del Linux577
1⤵
PID:660

/usr/bin/chkconfig
chkconfig --del Linux577
1⤵
PID:660

/sbin/chkconfig
chkconfig --del Linux577
1⤵
PID:660

/bin/chkconfig
chkconfig --del Linux577
1⤵
PID:660

/usr/local/sbin/update-rc.d
update-rc.d Linux577 remove
1⤵
PID:662

/usr/local/bin/update-rc.d
update-rc.d Linux577 remove
1⤵
PID:662

/usr/local/sbin/chkconfig
chkconfig --add ".chinaz{1679910169"
1⤵
PID:664

/usr/local/bin/chkconfig
chkconfig --add ".chinaz{1679910169"
1⤵
PID:664

/usr/sbin/chkconfig
chkconfig --add ".chinaz{1679910169"
1⤵
PID:664

/usr/bin/chkconfig
chkconfig --add ".chinaz{1679910169"
1⤵
PID:664

/sbin/chkconfig
chkconfig --add ".chinaz{1679910169"
1⤵
PID:664

/bin/chkconfig
chkconfig --add ".chinaz{1679910169"
1⤵
PID:664

/usr/sbin/update-rc.d
update-rc.d Linux577 remove
1⤵
- Modifies rc script
- Write file to user bin folder
PID:662

/usr/local/sbin/systemctl
systemctl daemon-reload
2⤵
PID:673

/usr/local/bin/systemctl
systemctl daemon-reload
2⤵
PID:673

/usr/sbin/systemctl
systemctl daemon-reload
2⤵
PID:673

/usr/bin/systemctl
systemctl daemon-reload
2⤵
PID:673

/sbin/systemctl
systemctl daemon-reload
2⤵
PID:673

/bin/systemctl
systemctl daemon-reload
2⤵
- Reads runtime system information
PID:673

/usr/local/sbin/update-rc.d
update-rc.d ".chinaz{1679910169" defaults
1⤵
PID:667

/usr/local/bin/update-rc.d
update-rc.d ".chinaz{1679910169" defaults
1⤵
PID:667

/usr/sbin/update-rc.d
update-rc.d ".chinaz{1679910169" defaults
1⤵
- Modifies init.d
- Modifies rc script
- Write file to user bin folder
PID:667

/usr/local/sbin/systemctl
systemctl daemon-reload
2⤵
PID:674

/usr/local/bin/systemctl
systemctl daemon-reload
2⤵
PID:674

/usr/sbin/systemctl
systemctl daemon-reload
2⤵
PID:674

/usr/bin/systemctl
systemctl daemon-reload
2⤵
PID:674

/sbin/systemctl
systemctl daemon-reload
2⤵
PID:674

/bin/systemctl
systemctl daemon-reload
2⤵
- Reads runtime system information
PID:674

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/cron.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/cron.sh' >> /etc/crontab"
1⤵
PID:669