664fd170b1d07e372b3daa91aab78a8151d3f0b0361a2b3157b405314dd219a2 | Triage

Resubmissions

20-04-2023 08:22

230420-j9jsfaae7s 10

27-03-2023 09:38

230327-lmbvescg32 10

Analysis

max time kernel
80s
max time network
40s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20-04-2023 08:22

Sharing

Report Analysis Logs

General

Target

a09
Size

611KB
MD5

d1b5b4b4b5a118e384c7ff487e14ac3f
SHA1

038b7e9406fe5cb0a0be8f95ac935923c6d83c28
SHA256

0a312a4154dcec2bc6ce1d3b51c037b122ace5848ec99c2b861ab6124addae9b
SHA512

20885f782beeca1712924d6dec7fa474fb2fa7f926d7cbdbdd5f7fa18f6a3ac2bcd5dbd771a80c13c3403cbad05f2cda86ffefdc8170d6cc0f0b4b01a5baec74
SSDEEP

12288:UB1tATMVAqnf+ExxBHYpmA38X8LYkCW6TiLx6yB1/iGK4UlUuTh1AG:UB1BVpmExDYp38X8LYTWhLfNiGQl/91h

Score

9^/10

persistence

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 4 IoCs

Hijack Execution Flow

Processes:

description	ioc
/bin/qajarxjvzp	/bin/qajarxjvzp
/bin/atduvidcfo	/bin/atduvidcfo
/bin/udywhckwbr	/bin/udywhckwbr
/bin/volvurjkiq	/bin/volvurjkiq

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Scheduled Task

Processes:

shsed

description	ioc	Process
/etc/crontab	/etc/crontab	sh
/etc/crontab	/etc/crontab	sed

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

Boot or Logon Autostart Execution

Processes:

description	ioc
/etc/init.d/o��(o��o��(o��	/etc/init.d/o��(o��o��(o��

Modifies rc script 1 TTPs 17 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

Boot or Logon Autostart Execution

Processes:

update-rc.d

description	ioc	Process
/etc/rc2.d/S90o��(o��o��(o��	/etc/rc2.d/S90o��(o��o��(o��