c0b0225201fd3a4c08245e58bbb4b844e0d3426e89b9ac3fc34db37d994fb182

Resubmissions

20-04-2023 08:22

230420-j9l8kage69 10

06-04-2023 11:30

230406-nmjw5sch23 10

06-04-2023 11:14

230406-ncbssaef5z 10

26-03-2023 14:49

230326-r6z91sag91 10

Analysis

max time kernel
38s
max time network
139s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20-04-2023 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

task2.bin.elf
Size

611KB
MD5

12fecefe30f2ad8f49aae67b92920adc
SHA1

1bba1ff3c667a41ae26b12995323f7df7c239173
SHA256

c0b0225201fd3a4c08245e58bbb4b844e0d3426e89b9ac3fc34db37d994fb182
SHA512

71cd6c7490c62629774ffc31ac2cbe3074949b7b7d1445044d1be649b8893c59a45930c813939c2af95bc91612bfad7e4fe301ec6a96012ea5a6e8caa0d344c0
SSDEEP

12288:5BXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrrIT6yF8EEP4UlUuTh1Au:5BXmkN/+Fhu/Qo4h9L+zNNIBVEBl/91l

Score

9^/10

persistence

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 4 IoCs

Hijack Execution Flow

T1574

description	ioc
/bin/gkfsbrgihw	/bin/gkfsbrgihw
/bin/oebvndppvv	/bin/oebvndppvv
/bin/fyjmwwcrkm	/bin/fyjmwwcrkm
/bin/lgcdpuqhbn	/bin/lgcdpuqhbn

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task

T1053

description	ioc	Process
/etc/crontab	/etc/crontab	sed
/etc/crontab	/etc/crontab	sh

Modifies rc script 1 TTPs 12 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
/etc/rc1.d/S90task2.bin.elf	/etc/rc1.d/S90task2.bin.elf	Process not Found
/etc/rc2.d/S90task2.bin.elf	/etc/rc2.d/S90task2.bin.elf	Process not Found
/etc/rc4.d/S90task2.bin.elf	/etc/rc4.d/S90task2.bin.elf	Process not Found
/etc/rc5.d/S90task2.bin.elf	/etc/rc5.d/S90task2.bin.elf	Process not Found
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d
/etc/rc3.d/S90task2.bin.elf	/etc/rc3.d/S90task2.bin.elf	Process not Found
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc6.d/	/etc/rc6.d/	update-rc.d

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	103.106.245.71
Destination IP	72.52.178.23

Write file to user bin folder 1 TTPs 7 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d
/usr/bin/lgcdpuqhbn	/usr/bin/lgcdpuqhbn	Process not Found
/usr/bin/gkfsbrgihw	/usr/bin/gkfsbrgihw	Process not Found
/usr/bin/zqmhkgwsls	/usr/bin/zqmhkgwsls	Process not Found
/usr/bin/oebvndppvv	/usr/bin/oebvndppvv	Process not Found
/usr/bin/fyjmwwcrkm	/usr/bin/fyjmwwcrkm	Process not Found
/usr/bin/esvzksxkik	/usr/bin/esvzksxkik	Process not Found

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	systemctl
/proc/self/stat	/proc/self/stat	systemctl
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl
/proc/1/environ	/proc/1/environ	systemctl
/proc/1/sched	/proc/1/sched	systemctl
/proc/cmdline	/proc/cmdline	systemctl
/proc/filesystems	/proc/filesystems	sed

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
/tmp/lgcdpuqhbn	/tmp/lgcdpuqhbn
/tmp/gkfsbrgihw	/tmp/gkfsbrgihw
/tmp/oebvndppvv	/tmp/oebvndppvv
/tmp/fyjmwwcrkm	/tmp/fyjmwwcrkm

/tmp/task2.bin.elf
/tmp/task2.bin.elf
1⤵
PID:596

/bin/chkconfig
chkconfig --add task2.bin.elf
1⤵
PID:599

/sbin/chkconfig
chkconfig --add task2.bin.elf
1⤵
PID:599

/usr/bin/chkconfig
chkconfig --add task2.bin.elf
1⤵
PID:599

/usr/sbin/chkconfig
chkconfig --add task2.bin.elf
1⤵
PID:599

/usr/local/bin/chkconfig
chkconfig --add task2.bin.elf
1⤵
PID:599

/usr/local/sbin/chkconfig
chkconfig --add task2.bin.elf
1⤵
PID:599

/usr/X11R6/bin/chkconfig
chkconfig --add task2.bin.elf
1⤵
PID:599

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:602
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:603

/bin/update-rc.d
update-rc.d task2.bin.elf defaults
1⤵
PID:601

/sbin/update-rc.d
update-rc.d task2.bin.elf defaults
1⤵
PID:601

/usr/bin/update-rc.d
update-rc.d task2.bin.elf defaults
1⤵
PID:601

/usr/sbin/update-rc.d
update-rc.d task2.bin.elf defaults
1⤵
- Modifies rc script
- Write file to user bin folder
PID:601
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:607

/usr/bin/lgcdpuqhbn
/usr/bin/lgcdpuqhbn "route -n" 597
1⤵
PID:609

/usr/bin/lgcdpuqhbn
/usr/bin/lgcdpuqhbn gnome-terminal 597
1⤵
PID:628

/usr/bin/lgcdpuqhbn
/usr/bin/lgcdpuqhbn ls 597
1⤵
PID:634

/usr/bin/lgcdpuqhbn
/usr/bin/lgcdpuqhbn ifconfig 597
1⤵
PID:637

/usr/bin/lgcdpuqhbn
/usr/bin/lgcdpuqhbn who 597
1⤵
PID:640

/usr/bin/gkfsbrgihw
/usr/bin/gkfsbrgihw "echo \"find\"" 597
1⤵
PID:643

/usr/bin/gkfsbrgihw
/usr/bin/gkfsbrgihw "cat resolv.conf" 597
1⤵
PID:646

/usr/bin/gkfsbrgihw
/usr/bin/gkfsbrgihw ifconfig 597
1⤵
PID:649

/usr/bin/gkfsbrgihw
/usr/bin/gkfsbrgihw "ifconfig eth0" 597
1⤵
PID:652

/usr/bin/gkfsbrgihw
/usr/bin/gkfsbrgihw sh 597
1⤵
PID:655

/usr/bin/zqmhkgwsls
/usr/bin/zqmhkgwsls sh 597
1⤵
PID:658

/usr/bin/zqmhkgwsls
/usr/bin/zqmhkgwsls ls 597
1⤵
PID:661

/usr/bin/zqmhkgwsls
/usr/bin/zqmhkgwsls "sleep 1" 597
1⤵
PID:664

/usr/bin/zqmhkgwsls
/usr/bin/zqmhkgwsls id 597
1⤵
PID:667

/usr/bin/zqmhkgwsls
/usr/bin/zqmhkgwsls su 597
1⤵
PID:670

/usr/bin/oebvndppvv
/usr/bin/oebvndppvv su 597
1⤵
PID:673

/usr/bin/oebvndppvv
/usr/bin/oebvndppvv "ifconfig eth0" 597
1⤵
PID:676

/usr/bin/oebvndppvv
/usr/bin/oebvndppvv sh 597
1⤵
PID:679

/usr/bin/oebvndppvv
/usr/bin/oebvndppvv sh 597
1⤵
PID:682

/usr/bin/oebvndppvv
/usr/bin/oebvndppvv gnome-terminal 597
1⤵
PID:685

/usr/bin/fyjmwwcrkm
/usr/bin/fyjmwwcrkm "sleep 1" 597
1⤵
PID:688

/usr/bin/fyjmwwcrkm
/usr/bin/fyjmwwcrkm "ls -la" 597
1⤵
PID:691

/usr/bin/fyjmwwcrkm
/usr/bin/fyjmwwcrkm sh 597
1⤵
PID:694

/usr/bin/fyjmwwcrkm
/usr/bin/fyjmwwcrkm "ls -la" 597
1⤵
PID:697

/usr/bin/fyjmwwcrkm
/usr/bin/fyjmwwcrkm "grep \"A\"" 597
1⤵
PID:700

/usr/bin/esvzksxkik
/usr/bin/esvzksxkik ifconfig 597
1⤵
PID:705

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task

T1053

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads