Resubmissions

20-04-2023 08:22

230420-j9jsfaae7s 10

27-03-2023 09:38

230327-lmbvescg32 10

Analysis

  • max time kernel
    154s
  • max time network
    102s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    20-04-2023 08:22

General

  • Target

    SAY123

  • Size

    551KB

  • MD5

    a62bd401421253c27fc38aa8803f1451

  • SHA1

    955d7153ae275b3b1cbef1f6d9fedf463de06e08

  • SHA256

    977750a1f015f1ffa51edfeeae498a82e979b1644f70bec9170db96247c6e371

  • SHA512

    9137448dde857b2f2b74fbd4488c6d00cc275da57d542d88a3b785d97257c232231fa13e792a124fef7cc5fcc36a18f7c82504944f3c3b324d3f3186ac09fe3b

  • SSDEEP

    12288:/ocX0ds1H10GyzD9GCsQoD5umHxqKhHEwPTXdGFwMI:Qck61eGk9lzotuO1hHEwLHj

Score
5/10

Malware Config

Signatures

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/SAY123
    /tmp/SAY123
    1⤵
      PID:597
      • /bin/sh
        sh -c "killall declient"
        2⤵
          PID:598
          • /usr/bin/killall
            killall declient
            3⤵
            • Reads runtime system information
            PID:599
      • /bin/sh
        sh -c "cat /proc/meminfo|grep MemTotal>/tmp/Meminfo"
        1⤵
          PID:603
          • /bin/cat
            cat /proc/meminfo
            2⤵
              PID:604
            • /bin/grep
              grep MemTotal
              2⤵
                PID:605
            • /bin/sh
              sh -c "ethtool eth2|grep Speed >/tmp/NetSpeedInfo"
              1⤵
                PID:606
                • /bin/grep
                  grep Speed
                  2⤵
                    PID:608
                • /bin/sh
                  sh -c "rm /tmp/NetSpeedInfo /tmp/Meminfo"
                  1⤵
                    PID:609
                    • /bin/rm
                      rm /tmp/NetSpeedInfo /tmp/Meminfo
                      2⤵
                      • Writes file to tmp directory
                      PID:610
                  • /bin/sh
                    sh -c "cat /proc/meminfo|grep MemTotal>/tmp/Meminfo"
                    1⤵
                      PID:618
                      • /bin/cat
                        cat /proc/meminfo
                        2⤵
                        • Reads runtime system information
                        PID:619
                      • /bin/grep
                        grep MemTotal
                        2⤵
                          PID:620
                      • /bin/sh
                        sh -c "ethtool eth2|grep Speed >/tmp/NetSpeedInfo"
                        1⤵
                          PID:621
                          • /bin/grep
                            grep Speed
                            2⤵
                              PID:623
                          • /bin/sh
                            sh -c "rm /tmp/NetSpeedInfo /tmp/Meminfo"
                            1⤵
                              PID:624
                              • /bin/rm
                                rm /tmp/NetSpeedInfo /tmp/Meminfo
                                2⤵
                                • Writes file to tmp directory
                                PID:625

                            Network

                            MITRE ATT&CK Matrix

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads