44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c

description	ioc
/bin/elgqrobzer	/bin/elgqrobzer
/bin/myjetwbtlp	/bin/myjetwbtlp
/bin/lyidyvrhff	/bin/lyidyvrhff
/bin/uqlztzdynj	/bin/uqlztzdynj
/bin/xtxtmqjnxi	/bin/xtxtmqjnxi
/bin/uadxizpuxy	/bin/uadxizpuxy

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task

description	ioc	Process
/etc/crontab	/etc/crontab	sh
/etc/crontab	/etc/crontab	sed

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

description	ioc
/etc/init.d/44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/init.d/44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c

Modifies rc script 1 TTPs 12 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

description	ioc	Process
/etc/rc1.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc1.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc2.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc2.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc5.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc5.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc3.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc3.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc4.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc4.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d

Write file to user bin folder 1 TTPs 7 IoCs

Hijack Execution Flow

description	ioc	Process
/usr/bin/xtxtmqjnxi	/usr/bin/xtxtmqjnxi	Process not Found
/usr/bin/uadxizpuxy	/usr/bin/uadxizpuxy	Process not Found
/usr/bin/elgqrobzer	/usr/bin/elgqrobzer	Process not Found
/usr/bin/myjetwbtlp	/usr/bin/myjetwbtlp	Process not Found
/usr/bin/lyidyvrhff	/usr/bin/lyidyvrhff	Process not Found
/usr/bin/uqlztzdynj	/usr/bin/uqlztzdynj	Process not Found
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/self/stat	/proc/self/stat	systemctl
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl
/proc/1/environ	/proc/1/environ	systemctl
/proc/1/sched	/proc/1/sched	systemctl
/proc/cmdline	/proc/cmdline	systemctl
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	systemctl

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
/tmp/elgqrobzer	/tmp/elgqrobzer
/tmp/myjetwbtlp	/tmp/myjetwbtlp
/tmp/lyidyvrhff	/tmp/lyidyvrhff
/tmp/uqlztzdynj	/tmp/uqlztzdynj
/tmp/44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/tmp/44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
/tmp/xtxtmqjnxi	/tmp/xtxtmqjnxi
/tmp/uadxizpuxy	/tmp/uadxizpuxy

/tmp/44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
/tmp/44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:609

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:615
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:616

/bin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:612

/sbin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:612

/usr/bin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:612

/usr/sbin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:612

/usr/local/bin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:612

/usr/local/sbin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:612

/usr/X11R6/bin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:612

/bin/update-rc.d
update-rc.d 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c defaults
1⤵
PID:614

/sbin/update-rc.d
update-rc.d 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c defaults
1⤵
PID:614

/usr/bin/update-rc.d
update-rc.d 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c defaults
1⤵
PID:614

/usr/sbin/update-rc.d
update-rc.d 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c defaults
1⤵
- Modifies rc script
- Write file to user bin folder
PID:614
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:625

/usr/bin/uadxizpuxy
/usr/bin/uadxizpuxy "sleep 1" 610
1⤵
PID:642

/usr/bin/uadxizpuxy
/usr/bin/uadxizpuxy su 610
1⤵
PID:645

/usr/bin/uadxizpuxy
/usr/bin/uadxizpuxy "netstat -antop" 610
1⤵
PID:648

/usr/bin/uadxizpuxy
/usr/bin/uadxizpuxy bash 610
1⤵
PID:651

/usr/bin/uadxizpuxy
/usr/bin/uadxizpuxy id 610
1⤵
PID:654

/usr/bin/elgqrobzer
/usr/bin/elgqrobzer "grep \"A\"" 610
1⤵
PID:657

/usr/bin/elgqrobzer
/usr/bin/elgqrobzer gnome-terminal 610
1⤵
PID:660

/usr/bin/elgqrobzer
/usr/bin/elgqrobzer id 610
1⤵
PID:663

/usr/bin/elgqrobzer
/usr/bin/elgqrobzer "ps -ef" 610
1⤵
PID:666

/usr/bin/elgqrobzer
/usr/bin/elgqrobzer who 610
1⤵
PID:669

/usr/bin/myjetwbtlp
/usr/bin/myjetwbtlp id 610
1⤵
PID:672

/usr/bin/myjetwbtlp
/usr/bin/myjetwbtlp "route -n" 610
1⤵
PID:675

/usr/bin/myjetwbtlp
/usr/bin/myjetwbtlp pwd 610
1⤵
PID:678

/usr/bin/myjetwbtlp
/usr/bin/myjetwbtlp gnome-terminal 610
1⤵
PID:681

/usr/bin/myjetwbtlp
/usr/bin/myjetwbtlp ls 610
1⤵
PID:684

/usr/bin/lyidyvrhff
/usr/bin/lyidyvrhff "ls -la" 610
1⤵
PID:687

/usr/bin/lyidyvrhff
/usr/bin/lyidyvrhff "sleep 1" 610
1⤵
PID:690

/usr/bin/lyidyvrhff
/usr/bin/lyidyvrhff who 610
1⤵
PID:693

/usr/bin/lyidyvrhff
/usr/bin/lyidyvrhff "sleep 1" 610
1⤵
PID:696

/usr/bin/lyidyvrhff
/usr/bin/lyidyvrhff "netstat -an" 610
1⤵
PID:699

/usr/bin/uqlztzdynj
/usr/bin/uqlztzdynj ls 610
1⤵
PID:704

/usr/bin/uqlztzdynj
/usr/bin/uqlztzdynj su 610
1⤵
PID:706

/usr/bin/uqlztzdynj
/usr/bin/uqlztzdynj who 610
1⤵
PID:710

/usr/bin/uqlztzdynj
/usr/bin/uqlztzdynj ifconfig 610
1⤵
PID:713

/usr/bin/uqlztzdynj
/usr/bin/uqlztzdynj bash 610
1⤵
PID:716

/usr/bin/sxqprpydgb
/usr/bin/sxqprpydgb who 610
1⤵
PID:719

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Hijack Execution Flow

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Hijack Execution Flow

Scheduled Task

Defense Evasion

Hijack Execution Flow