664fd170b1d07e372b3daa91aab78a8151d3f0b0361a2b3157b405314dd219a2 | Triage

Resubmissions

20-04-2023 08:22

230420-j9jsfaae7s 10

27-03-2023 09:38

230327-lmbvescg32 10

Analysis

max time kernel
60s
max time network
40s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20-04-2023 08:22

Sharing

Report Analysis Logs

General

Target

a10
Size

611KB
MD5

83eea5625ca2affd3e841d3b374e88eb
SHA1

dca946f677a1be95fb3ef6adc950730b4736a405
SHA256

fd6060b963d1b5ca7a07b5a283ad99105298a6708e44d286440a506738a17e34
SHA512

a856a78004812a5aa75f52ecaa3690d5edfc98179b4c34f23434cd9d60e0a0ea7dc6e3ab30e311f7da088267de026552155c9a46cc3c3dda99544e67969e3a1c
SSDEEP

12288:UB1tATMVAqnf+ExxBHYpmA38X8LYkCW6Tipx6yB1/iGK4UlUuTh1AG:UB1BVpmExDYp38X8LYTWhpfNiGQl/91h

Score

9^/10

persistence

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 3 IoCs

Hijack Execution Flow

Processes:

description	ioc
/bin/varvssyzhy	/bin/varvssyzhy
/bin/nlrebinuma	/bin/nlrebinuma
/bin/ombsdfttwj	/bin/ombsdfttwj

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Scheduled Task

Processes:

sedsh

description	ioc	Process
/etc/crontab	/etc/crontab	sed
/etc/crontab	/etc/crontab	sh

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

Boot or Logon Autostart Execution

Processes:

description	ioc
/etc/init.d/� ��	/etc/init.d/� ��

Modifies rc script 1 TTPs 17 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

Boot or Logon Autostart Execution

Processes:

update-rc.d

description	ioc	Process
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d
/etc/rc3.d/S90� ��	/etc/rc3.d/S90� ��