664fd170b1d07e372b3daa91aab78a8151d3f0b0361a2b3157b405314dd219a2 | Triage

Resubmissions

20-04-2023 08:22

230420-j9jsfaae7s 10

27-03-2023 09:38

230327-lmbvescg32 10

Analysis

max time kernel
60s
max time network
40s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20-04-2023 08:22

Sharing

Report Analysis Logs

General

Target

a10
Size

611KB
MD5

83eea5625ca2affd3e841d3b374e88eb
SHA1

dca946f677a1be95fb3ef6adc950730b4736a405
SHA256

fd6060b963d1b5ca7a07b5a283ad99105298a6708e44d286440a506738a17e34
SHA512

a856a78004812a5aa75f52ecaa3690d5edfc98179b4c34f23434cd9d60e0a0ea7dc6e3ab30e311f7da088267de026552155c9a46cc3c3dda99544e67969e3a1c
SSDEEP

12288:UB1tATMVAqnf+ExxBHYpmA38X8LYkCW6Tipx6yB1/iGK4UlUuTh1AG:UB1BVpmExDYp38X8LYTWhpfNiGQl/91h

Score

9^/10

persistence

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 3 IoCs

Hijack Execution Flow

description	ioc
/bin/varvssyzhy	/bin/varvssyzhy
/bin/nlrebinuma	/bin/nlrebinuma
/bin/ombsdfttwj	/bin/ombsdfttwj

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Scheduled Task

description	ioc	Process
/etc/crontab	/etc/crontab	sed
/etc/crontab	/etc/crontab	sh

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

Boot or Logon Autostart Execution

description	ioc
/etc/init.d/� ��	/etc/init.d/� ��

Modifies rc script 1 TTPs 17 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

Boot or Logon Autostart Execution

description	ioc	Process
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d
/etc/rc3.d/S90� ��	/etc/rc3.d/S90� ��	Process not Found
/etc/rc4.d/S90� ��	/etc/rc4.d/S90� ��	Process not Found
/etc/rc3.d/S90a10	/etc/rc3.d/S90a10	Process not Found
/etc/rc5.d/S90a10	/etc/rc5.d/S90a10	Process not Found
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc1.d/S90� ��	/etc/rc1.d/S90� ��	Process not Found
/etc/rc2.d/S90� ��	/etc/rc2.d/S90� ��	Process not Found
/etc/rc1.d/S90a10	/etc/rc1.d/S90a10	Process not Found
/etc/rc2.d/S90a10	/etc/rc2.d/S90a10	Process not Found
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc5.d/S90� ��	/etc/rc5.d/S90� ��	Process not Found
/etc/rc4.d/S90a10	/etc/rc4.d/S90a10	Process not Found
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d

Write file to user bin folder 1 TTPs 6 IoCs

Hijack Execution Flow

description	ioc	Process
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d
/usr/bin/varvssyzhy	/usr/bin/varvssyzhy	Process not Found
/usr/bin/xxdqzaojhj	/usr/bin/xxdqzaojhj	Process not Found
/usr/bin/nlrebinuma	/usr/bin/nlrebinuma	Process not Found
/usr/bin/ombsdfttwj	/usr/bin/ombsdfttwj	Process not Found
/usr/bin/bawozhnavg	/usr/bin/bawozhnavg	Process not Found

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl
/proc/1/environ	/proc/1/environ	systemctl
/proc/1/sched	/proc/1/sched	systemctl
/proc/cmdline	/proc/cmdline	systemctl
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	systemctl
/proc/self/stat	/proc/self/stat	systemctl

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
/tmp/varvssyzhy	/tmp/varvssyzhy
/tmp/nlrebinuma	/tmp/nlrebinuma
/tmp/ombsdfttwj	/tmp/ombsdfttwj

/tmp/a10
/tmp/a10
1⤵
PID:594

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:600
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:601

/bin/chkconfig
chkconfig --add a10
1⤵
PID:597

/sbin/chkconfig
chkconfig --add a10
1⤵
PID:597

/usr/bin/chkconfig
chkconfig --add a10
1⤵
PID:597

/usr/sbin/chkconfig
chkconfig --add a10
1⤵
PID:597

/usr/local/bin/chkconfig
chkconfig --add a10
1⤵
PID:597

/usr/local/sbin/chkconfig
chkconfig --add a10
1⤵
PID:597

/usr/X11R6/bin/chkconfig
chkconfig --add a10
1⤵
PID:597

/bin/update-rc.d
update-rc.d a10 defaults
1⤵
PID:599

/sbin/update-rc.d
update-rc.d a10 defaults
1⤵
PID:599

/usr/bin/update-rc.d
update-rc.d a10 defaults
1⤵
PID:599

/usr/sbin/update-rc.d
update-rc.d a10 defaults
1⤵
- Modifies rc script
- Write file to user bin folder
PID:599
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:603

/usr/bin/varvssyzhy
/usr/bin/varvssyzhy who 595
1⤵
PID:624

/usr/bin/varvssyzhy
/usr/bin/varvssyzhy id 595
1⤵
PID:629

/usr/bin/varvssyzhy
/usr/bin/varvssyzhy "sleep 1" 595
1⤵
PID:632

/usr/bin/varvssyzhy
/usr/bin/varvssyzhy "ifconfig eth0" 595
1⤵
PID:635

/usr/bin/varvssyzhy
/usr/bin/varvssyzhy pwd 595
1⤵
PID:638

/usr/bin/xxdqzaojhj
/usr/bin/xxdqzaojhj top 595
1⤵
PID:641

/usr/bin/xxdqzaojhj
/usr/bin/xxdqzaojhj "netstat -an" 595
1⤵
PID:644

/usr/bin/xxdqzaojhj
/usr/bin/xxdqzaojhj "cd /etc" 595
1⤵
PID:647

/usr/bin/xxdqzaojhj
/usr/bin/xxdqzaojhj "cat resolv.conf" 595
1⤵
PID:650

/usr/bin/xxdqzaojhj
/usr/bin/xxdqzaojhj "echo \"find\"" 595
1⤵
PID:653

/usr/bin/nlrebinuma
/usr/bin/nlrebinuma "route -n" 595
1⤵
PID:656

/usr/bin/nlrebinuma
/usr/bin/nlrebinuma "ifconfig eth0" 595
1⤵
PID:659

/usr/bin/nlrebinuma
/usr/bin/nlrebinuma "cd /etc" 595
1⤵
PID:662

/usr/bin/nlrebinuma
/usr/bin/nlrebinuma "sleep 1" 595
1⤵
PID:665

/usr/bin/nlrebinuma
/usr/bin/nlrebinuma sh 595
1⤵
PID:668

/usr/bin/ombsdfttwj
/usr/bin/ombsdfttwj whoami 595
1⤵
PID:671

/usr/bin/ombsdfttwj
/usr/bin/ombsdfttwj "ls -la" 595
1⤵
PID:674

/usr/bin/ombsdfttwj
/usr/bin/ombsdfttwj ifconfig 595
1⤵
PID:677

/usr/bin/ombsdfttwj
/usr/bin/ombsdfttwj id 595
1⤵
PID:680

/usr/bin/ombsdfttwj
/usr/bin/ombsdfttwj "route -n" 595
1⤵
PID:683

/usr/bin/oqbyuhlnfx
/usr/bin/oqbyuhlnfx uptime 595
1⤵
PID:703

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Hijack Execution Flow

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Hijack Execution Flow

Scheduled Task

Defense Evasion

Hijack Execution Flow

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads