Overview
overview
10Static
static
10.sshdd
ubuntu-18.04-amd64
7261664
ubuntu-18.04-amd64
832
ubuntu-18.04-amd64
136000.exe
windows7-x64
736000.exe
windows10-2004-x64
764
ubuntu-18.04-amd64
8GetPass.exe
windows7-x64
7GetPass.exe
windows10-2004-x64
7NetSyst81.dll
windows7-x64
1NetSyst81.dll
windows10-2004-x64
1POP
ubuntu-18.04-amd64
1SAY123
ubuntu-18.04-amd64
5SAY456
ubuntu-18.04-amd64
8TomDog_Result.html
windows7-x64
1TomDog_Result.html
windows10-2004-x64
1a06
ubuntu-18.04-amd64
9a07
ubuntu-18.04-amd64
9a08
ubuntu-18.04-amd64
9a09
ubuntu-18.04-amd64
9a10
ubuntu-18.04-amd64
9banner313.pl
ubuntu-18.04-amd64
banner313.pl
debian-9-armhf
banner313.pl
debian-9-mips
banner313.pl
debian-9-mipsel
f.sh
ubuntu-18.04-amd64
5f.sh
debian-9-armhf
5f.sh
debian-9-mips
5f.sh
debian-9-mipsel
5g3m.pl
ubuntu-18.04-amd64
g3m.pl
debian-9-armhf
g3m.pl
debian-9-mips
g3m.pl
debian-9-mipsel
Analysis
-
max time kernel
155s -
max time network
135s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20221111-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
20-04-2023 08:22
Behavioral task
behavioral1
Sample
.sshdd
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral2
Sample
261664
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral3
Sample
32
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral4
Sample
36000.exe
Resource
win7-20230220-en
Behavioral task
behavioral5
Sample
36000.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
64
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral7
Sample
GetPass.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
GetPass.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
NetSyst81.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
NetSyst81.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
POP
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral12
Sample
SAY123
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral13
Sample
SAY456
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral14
Sample
TomDog_Result.html
Resource
win7-20230220-en
Behavioral task
behavioral15
Sample
TomDog_Result.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
a06
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral17
Sample
a07
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral18
Sample
a08
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral19
Sample
a09
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral20
Sample
a10
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral21
Sample
banner313.pl
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral22
Sample
banner313.pl
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral23
Sample
banner313.pl
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral24
Sample
banner313.pl
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral25
Sample
f.sh
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral26
Sample
f.sh
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral27
Sample
f.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral28
Sample
f.sh
Resource
debian9-mipsel-20221111-en
Behavioral task
behavioral29
Sample
g3m.pl
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral30
Sample
g3m.pl
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral31
Sample
g3m.pl
Resource
debian9-mipsbe-20221111-en
Behavioral task
behavioral32
Sample
g3m.pl
Resource
debian9-mipsel-en-20211208
General
-
Target
SAY456
-
Size
639KB
-
MD5
467771cc496a8764e143c772d3585072
-
SHA1
3233613081abf60ebd8bb04a97c9d9eeded025df
-
SHA256
c453e0d47de8106884381fcc0db2bf7927f714fc480fe31356809fff629c8a33
-
SHA512
c5cfad7c857a377850398df29190522bac911271bed4b2f6d17f91522173834f17daa38c53bdeb7c82796384aa21ea149abe18639425920003076095d69b7e0f
-
SSDEEP
12288:8Y62/fARweXwB5QXgn19w1k1a7s+95qXtPMZCLZZgyOQPAe5UyojTucN44XML:VdAywwBMgV1ux9cPM6LZJIu8N44o
Malware Config
Signatures
-
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc /etc/resolv.conf /etc/resolv.conf -
Reads CPU attributes 1 TTPs 1 IoCs
description ioc /sys/devices/system/cpu/online /sys/devices/system/cpu/online -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc /proc/net/dev /proc/net/dev -
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
description ioc Process /proc/meminfo /proc/meminfo cat /proc/stat /proc/stat Process not Found -
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process /tmp/NetSpeedInfo /tmp/NetSpeedInfo rm /tmp/Meminfo /tmp/Meminfo rm /tmp/Meminfo /tmp/Meminfo Process not Found /tmp/NetSpeedInfo /tmp/NetSpeedInfo Process not Found
Processes
-
/tmp/SAY456/tmp/SAY4561⤵PID:614
-
/bin/shsh -c "./dbuspm-session /tmp/SAY456 RunByP617 &"1⤵PID:618
-
./dbuspm-session./dbuspm-session /tmp/SAY456 RunByP6172⤵PID:619
-
-
/bin/shsh -c "echo `date` run ./dbuspm-session /tmp/SAY456 RunByP617 & >> /home/baicai/DDosClient-Linux/log"1⤵PID:620
-
/bin/shsh -c "echo `date` recv 1 619>> /home/baicai/DDosClient-Linux/log"1⤵PID:621
-
/bin/datedate2⤵PID:624
-
-
/bin/datedate1⤵PID:623
-
/bin/shsh -c "cat /proc/meminfo|grep MemTotal>/tmp/Meminfo"1⤵PID:629
-
/bin/catcat /proc/meminfo2⤵
- Reads runtime system information
PID:630
-
-
/bin/grepgrep MemTotal2⤵PID:631
-
-
/bin/shsh -c "ethtool eth2|grep Speed >/tmp/NetSpeedInfo"1⤵PID:632
-
/bin/grepgrep Speed2⤵PID:634
-
-
/bin/shsh -c "rm /tmp/NetSpeedInfo /tmp/Meminfo"1⤵PID:635
-
/bin/rmrm /tmp/NetSpeedInfo /tmp/Meminfo2⤵
- Writes file to tmp directory
PID:636
-