ce0f1914e0f0748f85ecc18d8470de2a0b2b60be7eaab7a459899f77993e82e6

Resubmissions

20-04-2023 08:21

230420-j9f2jsge66 10

28-03-2023 02:02

230328-cghaksac5s 10

Analysis

max time kernel
0s
max time network
44s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28-03-2023 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

yxbitkdccc_
Size

611KB
MD5

a2279a054fba006fd74c3b61ddc6a3ef
SHA1

df2a4c91d86be560c7c19628923b601af460258d
SHA256

ce0f1914e0f0748f85ecc18d8470de2a0b2b60be7eaab7a459899f77993e82e6
SHA512

089bf2ef2926e6cdd93412ce006fb06cf8c75f60c9adb475c4798532b2214e083b4d1a6dd29b864a77c9744a953e67a40c2dc7195661682cfaa268c549e9cbe5
SSDEEP

12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrryT6yF8EEP4UlUuTh1AR:FBXmkN/+Fhu/Qo4h9L+zNNyBVEBl/91I

Score

9^/10

persistence

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 4 IoCs

Hijack Execution Flow
T1574

Processes:

description ioc

/bin/ybhndvwqfl /bin/ybhndvwqfl
/bin/sbvcmaqthj /bin/sbvcmaqthj
/bin/yznbxjiymd /bin/yznbxjiymd
/bin/raphtduxix /bin/raphtduxix
Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task
T1053

Processes:

sedsh

description ioc process

/etc/crontab /etc/crontab sed
/etc/crontab /etc/crontab sh
Modifies init.d 1 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
persistence

Boot or Logon Autostart Execution
T1547

Processes:

description ioc

/etc/init.d/�� P�� /etc/init.d/�� P��

description	ioc
/bin/ybhndvwqfl	/bin/ybhndvwqfl
/bin/sbvcmaqthj	/bin/sbvcmaqthj
/bin/yznbxjiymd	/bin/yznbxjiymd
/bin/raphtduxix	/bin/raphtduxix

description	ioc	process
/etc/crontab	/etc/crontab	sed
/etc/crontab	/etc/crontab	sh

description	ioc
/etc/init.d/�� P��	/etc/init.d/�� P��

Modifies rc script 1 TTPs 17 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

Processes:

update-rc.d

description	ioc
/etc/rc3.d/S90yxbitkdccc_	/etc/rc3.d/S90yxbitkdccc_
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc2.d/S90�� P��	/etc/rc2.d/S90�� P��
/etc/rc5.d/S90�� P��	/etc/rc5.d/S90�� P��
/etc/rc4.d/S90yxbitkdccc_	/etc/rc4.d/S90yxbitkdccc_
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc3.d/S90�� P��	/etc/rc3.d/S90�� P��
/etc/rc5.d/S90yxbitkdccc_	/etc/rc5.d/S90yxbitkdccc_
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d
/etc/rc1.d/S90yxbitkdccc_	/etc/rc1.d/S90yxbitkdccc_
/etc/rc2.d/S90yxbitkdccc_	/etc/rc2.d/S90yxbitkdccc_
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc1.d/S90�� P��	/etc/rc1.d/S90�� P��
/etc/rc4.d/S90�� P��	/etc/rc4.d/S90�� P��

Write file to user bin folder 1 TTPs 7 IoCs

Hijack Execution Flow

T1574

Processes:

update-rc.d

description	ioc
/usr/bin/raphtduxix	/usr/bin/raphtduxix
/usr/bin/ybhndvwqfl	/usr/bin/ybhndvwqfl
/usr/bin/sbvcmaqthj	/usr/bin/sbvcmaqthj
/usr/bin/mfkxwerxxc	/usr/bin/mfkxwerxxc
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d
/usr/bin/yznbxjiymd	/usr/bin/yznbxjiymd
/usr/bin/mbwgsqazmh	/usr/bin/mbwgsqazmh

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

Processes:

systemctlsed

description	ioc	process
/proc/1/environ	/proc/1/environ	systemctl
/proc/1/sched	/proc/1/sched	systemctl
/proc/cmdline	/proc/cmdline	systemctl
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	systemctl
/proc/self/stat	/proc/self/stat	systemctl
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl

Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.

Processes:

description ioc

/tmp/yznbxjiymd /tmp/yznbxjiymd
/tmp/raphtduxix /tmp/raphtduxix
/tmp/ybhndvwqfl /tmp/ybhndvwqfl
/tmp/sbvcmaqthj /tmp/sbvcmaqthj

description	ioc
/tmp/yznbxjiymd	/tmp/yznbxjiymd
/tmp/raphtduxix	/tmp/raphtduxix
/tmp/ybhndvwqfl	/tmp/ybhndvwqfl
/tmp/sbvcmaqthj	/tmp/sbvcmaqthj

/tmp/yxbitkdccc_
/tmp/yxbitkdccc_
1⤵
PID:570

/bin/chkconfig
chkconfig --add yxbitkdccc_
1⤵
PID:573

/sbin/chkconfig
chkconfig --add yxbitkdccc_
1⤵
PID:573

/usr/bin/chkconfig
chkconfig --add yxbitkdccc_
1⤵
PID:573

/usr/sbin/chkconfig
chkconfig --add yxbitkdccc_
1⤵
PID:573

/usr/local/bin/chkconfig
chkconfig --add yxbitkdccc_
1⤵
PID:573

/bin/update-rc.d
update-rc.d yxbitkdccc_ defaults
1⤵
PID:575

/sbin/update-rc.d
update-rc.d yxbitkdccc_ defaults
1⤵
PID:575

/usr/bin/update-rc.d
update-rc.d yxbitkdccc_ defaults
1⤵
PID:575

/usr/local/sbin/chkconfig
chkconfig --add yxbitkdccc_
1⤵
PID:573

/usr/X11R6/bin/chkconfig
chkconfig --add yxbitkdccc_
1⤵
PID:573

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:576

/bin/sed
sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
2⤵
- Creates/modifies Cron job
- Reads runtime system information
PID:577

/usr/sbin/update-rc.d
update-rc.d yxbitkdccc_ defaults
1⤵
- Modifies rc script
- Write file to user bin folder
PID:575

/bin/systemctl
systemctl daemon-reload
2⤵
- Reads runtime system information
PID:585

/usr/bin/mbwgsqazmh
/usr/bin/mbwgsqazmh "ifconfig eth0" 571
1⤵
PID:602

/usr/bin/mbwgsqazmh
/usr/bin/mbwgsqazmh "echo \"find\"" 571
1⤵
PID:605

/usr/bin/mbwgsqazmh
/usr/bin/mbwgsqazmh pwd 571
1⤵
PID:608

/usr/bin/mbwgsqazmh
/usr/bin/mbwgsqazmh "ifconfig eth0" 571
1⤵
PID:611

/usr/bin/mbwgsqazmh
/usr/bin/mbwgsqazmh "echo \"find\"" 571
1⤵
PID:614

/usr/bin/raphtduxix
/usr/bin/raphtduxix "route -n" 571
1⤵
PID:617

/usr/bin/raphtduxix
/usr/bin/raphtduxix "grep \"A\"" 571
1⤵
PID:620

/usr/bin/raphtduxix
/usr/bin/raphtduxix ls 571
1⤵
PID:623

/usr/bin/raphtduxix
/usr/bin/raphtduxix "ifconfig eth0" 571
1⤵
PID:626

/usr/bin/raphtduxix
/usr/bin/raphtduxix "cat resolv.conf" 571
1⤵
PID:629

/usr/bin/sbvcmaqthj
/usr/bin/sbvcmaqthj "netstat -an" 571
1⤵
PID:647

/usr/bin/sbvcmaqthj
/usr/bin/sbvcmaqthj "grep \"A\"" 571
1⤵
PID:650

/usr/bin/sbvcmaqthj
/usr/bin/sbvcmaqthj pwd 571
1⤵
PID:653

/usr/bin/sbvcmaqthj
/usr/bin/sbvcmaqthj sh 571
1⤵
PID:656

/usr/bin/sbvcmaqthj
/usr/bin/sbvcmaqthj "netstat -antop" 571
1⤵
PID:659

/bin/chkconfig
chkconfig --del "�� P��"
1⤵
PID:681

/sbin/chkconfig
chkconfig --del "�� P��"
1⤵
PID:681

/usr/bin/chkconfig
chkconfig --del "�� P��"
1⤵
PID:681

/usr/sbin/chkconfig
chkconfig --del "�� P��"
1⤵
PID:681

/usr/local/bin/chkconfig
chkconfig --del "�� P��"
1⤵
PID:681

/usr/local/sbin/chkconfig
chkconfig --del "�� P��"
1⤵
PID:681

/usr/X11R6/bin/chkconfig
chkconfig --del "�� P��"
1⤵
PID:681

/bin/update-rc.d
update-rc.d "�� P��" remove
1⤵
PID:683

/sbin/update-rc.d
update-rc.d "�� P��" remove
1⤵
PID:683

/usr/bin/update-rc.d
update-rc.d "�� P��" remove
1⤵
PID:683

/usr/sbin/update-rc.d
update-rc.d "�� P��" remove
1⤵
PID:683

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Hijack Execution Flow

T1574

Scheduled Task

T1053

Boot or Logon Autostart Execution

T1547

Privilege Escalation

Hijack Execution Flow

T1574

Scheduled Task

T1053

Boot or Logon Autostart Execution

T1547

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads