ce0f1914e0f0748f85ecc18d8470de2a0b2b60be7eaab7a459899f77993e82e6

description	ioc
/bin/kyfqoycfvb	/bin/kyfqoycfvb
/bin/bntbpcngot	/bin/bntbpcngot
/bin/rsnxbpzglb	/bin/rsnxbpzglb
/bin/ajghbhvvvx	/bin/ajghbhvvvx
/bin/zpdxcbhquu	/bin/zpdxcbhquu

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task

description	ioc	Process
/etc/crontab	/etc/crontab	sed
/etc/crontab	/etc/crontab	sh

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

description	ioc
/etc/init.d/yxbitkdccc_.elf	/etc/init.d/yxbitkdccc_.elf

Modifies rc script 1 TTPs 12 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

description	ioc	Process
/etc/rc3.d/S90yxbitkdccc_.elf	/etc/rc3.d/S90yxbitkdccc_.elf	Process not Found
/etc/rc4.d/S90yxbitkdccc_.elf	/etc/rc4.d/S90yxbitkdccc_.elf	Process not Found
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc1.d/S90yxbitkdccc_.elf	/etc/rc1.d/S90yxbitkdccc_.elf	Process not Found
/etc/rc2.d/S90yxbitkdccc_.elf	/etc/rc2.d/S90yxbitkdccc_.elf	Process not Found
/etc/rc5.d/S90yxbitkdccc_.elf	/etc/rc5.d/S90yxbitkdccc_.elf	Process not Found
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d

Write file to user bin folder 1 TTPs 7 IoCs

Hijack Execution Flow

description	ioc	Process
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d
/usr/bin/kyfqoycfvb	/usr/bin/kyfqoycfvb	Process not Found
/usr/bin/yzoqtfzbrl	/usr/bin/yzoqtfzbrl	Process not Found
/usr/bin/bntbpcngot	/usr/bin/bntbpcngot	Process not Found
/usr/bin/rsnxbpzglb	/usr/bin/rsnxbpzglb	Process not Found
/usr/bin/ajghbhvvvx	/usr/bin/ajghbhvvvx	Process not Found
/usr/bin/zpdxcbhquu	/usr/bin/zpdxcbhquu	Process not Found

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/1/sched	/proc/1/sched	systemctl
/proc/cmdline	/proc/cmdline	systemctl
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	systemctl
/proc/self/stat	/proc/self/stat	systemctl
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl
/proc/1/environ	/proc/1/environ	systemctl

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
/tmp/rsnxbpzglb	/tmp/rsnxbpzglb
/tmp/ajghbhvvvx	/tmp/ajghbhvvvx
/tmp/zpdxcbhquu	/tmp/zpdxcbhquu
/tmp/yxbitkdccc_.elf	/tmp/yxbitkdccc_.elf
/tmp/kyfqoycfvb	/tmp/kyfqoycfvb
/tmp/bntbpcngot	/tmp/bntbpcngot

/tmp/yxbitkdccc_.elf
/tmp/yxbitkdccc_.elf
1⤵
PID:570

/bin/chkconfig
chkconfig --add yxbitkdccc_.elf
1⤵
PID:573

/sbin/chkconfig
chkconfig --add yxbitkdccc_.elf
1⤵
PID:573

/usr/bin/chkconfig
chkconfig --add yxbitkdccc_.elf
1⤵
PID:573

/usr/sbin/chkconfig
chkconfig --add yxbitkdccc_.elf
1⤵
PID:573

/usr/local/bin/chkconfig
chkconfig --add yxbitkdccc_.elf
1⤵
PID:573

/usr/local/sbin/chkconfig
chkconfig --add yxbitkdccc_.elf
1⤵
PID:573

/usr/X11R6/bin/chkconfig
chkconfig --add yxbitkdccc_.elf
1⤵
PID:573

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:576
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:577

/bin/update-rc.d
update-rc.d yxbitkdccc_.elf defaults
1⤵
PID:575

/sbin/update-rc.d
update-rc.d yxbitkdccc_.elf defaults
1⤵
PID:575

/usr/bin/update-rc.d
update-rc.d yxbitkdccc_.elf defaults
1⤵
PID:575

/usr/sbin/update-rc.d
update-rc.d yxbitkdccc_.elf defaults
1⤵
- Modifies rc script
- Write file to user bin folder
PID:575
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:581

/usr/bin/yzoqtfzbrl
/usr/bin/yzoqtfzbrl "ps -ef" 571
1⤵
PID:602

/usr/bin/yzoqtfzbrl
/usr/bin/yzoqtfzbrl "ps -ef" 571
1⤵
PID:605

/usr/bin/yzoqtfzbrl
/usr/bin/yzoqtfzbrl bash 571
1⤵
PID:608

/usr/bin/yzoqtfzbrl
/usr/bin/yzoqtfzbrl su 571
1⤵
PID:611

/usr/bin/yzoqtfzbrl
/usr/bin/yzoqtfzbrl who 571
1⤵
PID:614

/usr/bin/bntbpcngot
/usr/bin/bntbpcngot ifconfig 571
1⤵
PID:617

/usr/bin/bntbpcngot
/usr/bin/bntbpcngot "echo \"find\"" 571
1⤵
PID:620

/usr/bin/bntbpcngot
/usr/bin/bntbpcngot "route -n" 571
1⤵
PID:623

/usr/bin/bntbpcngot
/usr/bin/bntbpcngot uptime 571
1⤵
PID:626

/usr/bin/bntbpcngot
/usr/bin/bntbpcngot "echo \"find\"" 571
1⤵
PID:629

/usr/bin/rsnxbpzglb
/usr/bin/rsnxbpzglb bash 571
1⤵
PID:635

/usr/bin/rsnxbpzglb
/usr/bin/rsnxbpzglb "route -n" 571
1⤵
PID:638

/usr/bin/rsnxbpzglb
/usr/bin/rsnxbpzglb su 571
1⤵
PID:641

/usr/bin/rsnxbpzglb
/usr/bin/rsnxbpzglb ls 571
1⤵
PID:644

/usr/bin/ajghbhvvvx
/usr/bin/ajghbhvvvx "netstat -antop" 571
1⤵
PID:647

/usr/bin/ajghbhvvvx
/usr/bin/ajghbhvvvx "sleep 1" 571
1⤵
PID:650

/usr/bin/ajghbhvvvx
/usr/bin/ajghbhvvvx who 571
1⤵
PID:653

/usr/bin/ajghbhvvvx
/usr/bin/ajghbhvvvx sh 571
1⤵
PID:656

/usr/bin/ajghbhvvvx
/usr/bin/ajghbhvvvx "netstat -antop" 571
1⤵
PID:659

/usr/bin/zpdxcbhquu
/usr/bin/zpdxcbhquu gnome-terminal 571
1⤵
PID:662

/usr/bin/zpdxcbhquu
/usr/bin/zpdxcbhquu "echo \"find\"" 571
1⤵
PID:665

/usr/bin/zpdxcbhquu
/usr/bin/zpdxcbhquu "echo \"find\"" 571
1⤵
PID:668

/usr/bin/zpdxcbhquu
/usr/bin/zpdxcbhquu uptime 571
1⤵
PID:671

/usr/bin/zpdxcbhquu
/usr/bin/zpdxcbhquu "netstat -antop" 571
1⤵
PID:674

/usr/bin/fzlmbbbgnz
/usr/bin/fzlmbbbgnz "netstat -an" 571
1⤵
PID:677

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Hijack Execution Flow

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Hijack Execution Flow

Scheduled Task

Defense Evasion

Hijack Execution Flow