Analysis
-
max time kernel
155s -
max time network
135s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20221111-en -
resource tags
-
submitted
20-04-2023 08:22
General
-
Target
SAY456
-
Size
639KB
-
MD5
467771cc496a8764e143c772d3585072
-
SHA1
3233613081abf60ebd8bb04a97c9d9eeded025df
-
SHA256
c453e0d47de8106884381fcc0db2bf7927f714fc480fe31356809fff629c8a33
-
SHA512
c5cfad7c857a377850398df29190522bac911271bed4b2f6d17f91522173834f17daa38c53bdeb7c82796384aa21ea149abe18639425920003076095d69b7e0f
-
SSDEEP
12288:8Y62/fARweXwB5QXgn19w1k1a7s+95qXtPMZCLZZgyOQPAe5UyojTucN44XML:VdAywwBMgV1ux9cPM6LZJIu8N44o
Score
8/10
Malware Config
Signatures
-
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
-
Reads CPU attributes 1 TTPs 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/SAY456/tmp/SAY4561⤵
-
/bin/shsh -c "./dbuspm-session /tmp/SAY456 RunByP617 &"1⤵
-
./dbuspm-session./dbuspm-session /tmp/SAY456 RunByP6172⤵
-
-
/bin/shsh -c "echo `date` run ./dbuspm-session /tmp/SAY456 RunByP617 & >> /home/baicai/DDosClient-Linux/log"1⤵
-
/bin/shsh -c "echo `date` recv 1 619>> /home/baicai/DDosClient-Linux/log"1⤵
-
/bin/datedate2⤵
-
-
/bin/datedate1⤵
-
/bin/shsh -c "cat /proc/meminfo|grep MemTotal>/tmp/Meminfo"1⤵
-
/bin/catcat /proc/meminfo2⤵
- Reads runtime system information
-
-
/bin/grepgrep MemTotal2⤵
-
-
/bin/shsh -c "ethtool eth2|grep Speed >/tmp/NetSpeedInfo"1⤵
-
/bin/grepgrep Speed2⤵
-
-
/bin/shsh -c "rm /tmp/NetSpeedInfo /tmp/Meminfo"1⤵
-
/bin/rmrm /tmp/NetSpeedInfo /tmp/Meminfo2⤵
- Writes file to tmp directory
-