Resubmissions

20-04-2023 08:22

230420-j9jsfaae7s 10

27-03-2023 09:38

230327-lmbvescg32 10

Analysis

  • max time kernel
    61s
  • max time network
    39s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20221111-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    20-04-2023 08:22

General

  • Target

    a08

  • Size

    611KB

  • MD5

    a99c10cb9713770b9e7dda376cddee3a

  • SHA1

    1f1dd4d74eba8949fb1d2316c13f77b3ffa96f98

  • SHA256

    92a260d856e00056469fb26f5305a37f6ab443d735d1476281b053b10b3c4f86

  • SHA512

    1d410a7259469a16a1599fb28cb7cd82813270a112055e4fbe28327735a2968affbfdcba0a2001d504919e5ef3b271f40c45da6291be9c5f97c278418b241b79

  • SSDEEP

    12288:UB1tATMVAqnf+ExxBHYpmA38X8LYkCW6TiOx6yB1/iGK4UlUuTh1AG:UB1BVpmExDYp38X8LYTWhOfNiGQl/91h

Score
9/10

Malware Config

Signatures

  • Writes file to system bin folder 1 TTPs 4 IoCs
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Modifies init.d 1 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

  • Modifies rc script 1 TTPs 17 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

  • Write file to user bin folder 1 TTPs 6 IoCs
  • Reads runtime system information 7 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/a08
    /tmp/a08
    1⤵
      PID:610
    • /bin/chkconfig
      chkconfig --add a08
      1⤵
        PID:613
      • /sbin/chkconfig
        chkconfig --add a08
        1⤵
          PID:613
        • /usr/bin/chkconfig
          chkconfig --add a08
          1⤵
            PID:613
          • /usr/sbin/chkconfig
            chkconfig --add a08
            1⤵
              PID:613
            • /usr/local/bin/chkconfig
              chkconfig --add a08
              1⤵
                PID:613
              • /usr/local/sbin/chkconfig
                chkconfig --add a08
                1⤵
                  PID:613
                • /usr/X11R6/bin/chkconfig
                  chkconfig --add a08
                  1⤵
                    PID:613
                  • /bin/sh
                    sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
                    1⤵
                    • Creates/modifies Cron job
                    PID:616
                    • /bin/sed
                      sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
                      2⤵
                      • Creates/modifies Cron job
                      • Reads runtime system information
                      PID:617
                  • /bin/update-rc.d
                    update-rc.d a08 defaults
                    1⤵
                      PID:615
                    • /sbin/update-rc.d
                      update-rc.d a08 defaults
                      1⤵
                        PID:615
                      • /usr/bin/update-rc.d
                        update-rc.d a08 defaults
                        1⤵
                          PID:615
                        • /usr/sbin/update-rc.d
                          update-rc.d a08 defaults
                          1⤵
                          • Modifies rc script
                          • Write file to user bin folder
                          PID:615
                          • /bin/systemctl
                            systemctl daemon-reload
                            2⤵
                            • Reads runtime system information
                            PID:619
                        • /usr/bin/xscwlblmay
                          /usr/bin/xscwlblmay "ls -la" 611
                          1⤵
                            PID:642
                          • /usr/bin/xscwlblmay
                            /usr/bin/xscwlblmay whoami 611
                            1⤵
                              PID:645
                            • /usr/bin/xscwlblmay
                              /usr/bin/xscwlblmay "netstat -an" 611
                              1⤵
                                PID:648
                              • /usr/bin/xscwlblmay
                                /usr/bin/xscwlblmay "netstat -an" 611
                                1⤵
                                  PID:651
                                • /usr/bin/xscwlblmay
                                  /usr/bin/xscwlblmay id 611
                                  1⤵
                                    PID:654
                                  • /usr/bin/kaovqjvytm
                                    /usr/bin/kaovqjvytm "ps -ef" 611
                                    1⤵
                                      PID:657
                                    • /usr/bin/kaovqjvytm
                                      /usr/bin/kaovqjvytm "echo \"find\"" 611
                                      1⤵
                                        PID:660
                                      • /usr/bin/kaovqjvytm
                                        /usr/bin/kaovqjvytm "ps -ef" 611
                                        1⤵
                                          PID:663
                                        • /usr/bin/kaovqjvytm
                                          /usr/bin/kaovqjvytm "cat resolv.conf" 611
                                          1⤵
                                            PID:666
                                          • /usr/bin/kaovqjvytm
                                            /usr/bin/kaovqjvytm "route -n" 611
                                            1⤵
                                              PID:669
                                            • /usr/bin/cbmedlvoic
                                              /usr/bin/cbmedlvoic sh 611
                                              1⤵
                                                PID:672
                                              • /usr/bin/cbmedlvoic
                                                /usr/bin/cbmedlvoic ifconfig 611
                                                1⤵
                                                  PID:675
                                                • /usr/bin/cbmedlvoic
                                                  /usr/bin/cbmedlvoic bash 611
                                                  1⤵
                                                    PID:678
                                                  • /usr/bin/cbmedlvoic
                                                    /usr/bin/cbmedlvoic bash 611
                                                    1⤵
                                                      PID:684
                                                    • /usr/bin/hyejseinoo
                                                      /usr/bin/hyejseinoo top 611
                                                      1⤵
                                                        PID:719

                                                      Network

                                                      MITRE ATT&CK Enterprise v6

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads