Analysis
-
max time kernel
155s -
max time network
157s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20221111-en -
resource tags
-
submitted
20-04-2023 08:22
General
-
Target
.sshdd
-
Size
647KB
-
MD5
33229183c1a701376ef15a0af4f9dc5b
-
SHA1
b6a981f7d1e3141bc99e448ca5ea88e4f973463c
-
SHA256
4e6eb417b5598ed171d383e6d6e3f1dc861438a52cfd869bbfaebabb8905f622
-
SHA512
af69aabf1cb1463cf425d23fdab57d43eca545c86211c4dd7d2a14d27803f461aebebbf2108df8033b16f208e26026f5c3ae3cc578d7d893ba5487e992fbe419
-
SSDEEP
12288:RBRO1UmJJ0nHgBL9YfJip2qm+x4h1Tonnp6y07l7mtBDvnD/u9hMHDB:RBRpmJ+HyL9AiAqm+x4h1mn6wvnDWXMN
Score
7/10
Malware Config
Signatures
-
Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Modifies rc script 1 TTPs 12 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
-
Unexpected DNS network traffic destination 37 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Write file to user bin folder 1 TTPs 1 IoCs
-
Reads runtime system information 7 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/.sshdd/tmp/.sshdd1⤵
-
/boot/zjohittxxv/boot/zjohittxxv1⤵
-
/bin/shsh -c "sed -i '/\\/etc\\/cron.hourly\\/cron.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/cron.sh' >> /etc/crontab"1⤵
- Creates/modifies Cron job
-
/bin/sedsed -i "/\\/etc\\/cron.hourly\\/cron.sh/d" /etc/crontab2⤵
- Creates/modifies Cron job
- Reads runtime system information
-
/bin/chkconfigchkconfig --add zjohittxxv1⤵
-
/sbin/chkconfigchkconfig --add zjohittxxv1⤵
-
/usr/bin/chkconfigchkconfig --add zjohittxxv1⤵
-
/usr/sbin/chkconfigchkconfig --add zjohittxxv1⤵
-
/usr/local/bin/chkconfigchkconfig --add zjohittxxv1⤵
-
/usr/local/sbin/chkconfigchkconfig --add zjohittxxv1⤵
-
/usr/X11R6/bin/chkconfigchkconfig --add zjohittxxv1⤵
-
/bin/update-rc.dupdate-rc.d zjohittxxv defaults1⤵
-
/sbin/update-rc.dupdate-rc.d zjohittxxv defaults1⤵
-
/usr/bin/update-rc.dupdate-rc.d zjohittxxv defaults1⤵
-
/usr/sbin/update-rc.dupdate-rc.d zjohittxxv defaults1⤵
- Modifies rc script
- Write file to user bin folder
-
/bin/systemctlsystemctl daemon-reload2⤵
- Reads runtime system information
-
/boot/tucfhtvqwt/boot/tucfhtvqwt gnome-terminal 6031⤵
-
/boot/svezpahmcq/boot/svezpahmcq "ifconfig eth0" 6031⤵
-
/boot/labkmtrozp/boot/labkmtrozp "echo \"find\"" 6031⤵
-
/boot/readmfdjud/boot/readmfdjud whoami 6031⤵
-
/boot/ycbqarpxaq/boot/ycbqarpxaq "ps -ef" 6031⤵
-
/boot/ukddkrdohn/boot/ukddkrdohn "netstat -an" 6031⤵
-
/boot/eadonxumqw/boot/eadonxumqw "cd /etc" 6031⤵
-
/boot/akunmpmtya/boot/akunmpmtya pwd 6031⤵
-
/boot/gibsvulbxf/boot/gibsvulbxf ifconfig 6031⤵
-
/boot/svvnwseveg/boot/svvnwseveg gnome-terminal 6031⤵
-
/boot/gwkvzxalne/boot/gwkvzxalne "echo \"find\"" 6031⤵
-
/boot/mwersinkjz/boot/mwersinkjz ls 6031⤵
-
/boot/rauostaels/boot/rauostaels "ls -la" 6031⤵
-
/boot/wljosuhgwa/boot/wljosuhgwa "cd /etc" 6031⤵
-
/boot/ijynxualur/boot/ijynxualur "netstat -an" 6031⤵
-
/boot/reasemoxfd/boot/reasemoxfd id 6031⤵
-
/boot/frdgqvhndj/boot/frdgqvhndj "netstat -antop" 6031⤵
-
/boot/uzpsvmvqxh/boot/uzpsvmvqxh "ls -la" 6031⤵
-
/boot/twhdfprjcs/boot/twhdfprjcs top 6031⤵
-
/boot/tkwmsjcjgi/boot/tkwmsjcjgi id 6031⤵
-
/boot/gtsejatfuf/boot/gtsejatfuf "grep \"A\"" 6031⤵
-
/boot/pqjhwfwdks/boot/pqjhwfwdks ifconfig 6031⤵
-
/boot/kbyokonpiv/boot/kbyokonpiv pwd 6031⤵
-
/boot/exblzrotun/boot/exblzrotun pwd 6031⤵
-
/boot/uxpkxbbbgx/boot/uxpkxbbbgx "cat resolv.conf" 6031⤵
-
/boot/ukoqwtbdii/boot/ukoqwtbdii gnome-terminal 6031⤵
-
/boot/ftdncfvech/boot/ftdncfvech "sleep 1" 6031⤵
-
/boot/fgyxsvfvrl/boot/fgyxsvfvrl uptime 6031⤵
-
/boot/rimhqhixux/boot/rimhqhixux whoami 6031⤵
-
/boot/gsorgdvdhc/boot/gsorgdvdhc id 6031⤵