44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c

Resubmissions

20/04/2023, 08:22

230420-j9m5vsge72 10

20/04/2023, 08:22

18/04/2023, 12:06

06/04/2023, 23:21

21/03/2023, 12:03

15/03/2023, 16:56

25/11/2022, 09:55

Analysis

max time kernel
34s
max time network
87s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20/04/2023, 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
Size

611KB
MD5

bc57b23aa694336f34ce91037c97b196
SHA1

001a8484c9cc0ba429646cf4c7fcf9815a29b6cf
SHA256

44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
SHA512

d178e8c8db4a63ab88301a2fc2dd1ea2444fd508a8c80ac3a9b0109f43c6e00781a84415a6955028fe39dbe310b6950f7971e7258c03912586f980d04a88714c
SSDEEP

12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrrLT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNLBVEBl/91h

Score

9^/10

persistence

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 3 IoCs

Hijack Execution Flow

T1574

description	ioc
/bin/kgtjvucfht	/bin/kgtjvucfht
/bin/oqmvitedyf	/bin/oqmvitedyf
/bin/mrpjxomjel	/bin/mrpjxomjel

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task

T1053

description	ioc	Process
/etc/crontab	/etc/crontab	sed
/etc/crontab	/etc/crontab	sh

Modifies rc script 1 TTPs 12 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d
/etc/rc5.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc5.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc4.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc4.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc1.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc1.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc2.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc2.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found
/etc/rc3.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	/etc/rc3.d/S9044046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c	Process not Found

Write file to user bin folder 1 TTPs 6 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
/usr/bin/nzratbtgbv	/usr/bin/nzratbtgbv	Process not Found
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d
/usr/bin/kgtjvucfht	/usr/bin/kgtjvucfht	Process not Found
/usr/bin/oqmvitedyf	/usr/bin/oqmvitedyf	Process not Found
/usr/bin/vssrnnsdgh	/usr/bin/vssrnnsdgh	Process not Found
/usr/bin/mrpjxomjel	/usr/bin/mrpjxomjel	Process not Found

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/1/sched	/proc/1/sched	systemctl
/proc/cmdline	/proc/cmdline	systemctl
/proc/filesystems	/proc/filesystems	sed
/proc/filesystems	/proc/filesystems	systemctl
/proc/self/stat	/proc/self/stat	systemctl
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl
/proc/1/environ	/proc/1/environ	systemctl

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
/tmp/kgtjvucfht	/tmp/kgtjvucfht
/tmp/oqmvitedyf	/tmp/oqmvitedyf
/tmp/mrpjxomjel	/tmp/mrpjxomjel

/tmp/44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
/tmp/44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:589

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:595
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:596

/bin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:592

/sbin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:592

/usr/bin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:592

/usr/sbin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:592

/usr/local/bin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:592

/usr/local/sbin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:592

/usr/X11R6/bin/chkconfig
chkconfig --add 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c
1⤵
PID:592

/bin/update-rc.d
update-rc.d 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c defaults
1⤵
PID:594

/sbin/update-rc.d
update-rc.d 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c defaults
1⤵
PID:594

/usr/bin/update-rc.d
update-rc.d 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c defaults
1⤵
PID:594

/usr/sbin/update-rc.d
update-rc.d 44046ce4a3a47b4d22ac7697817bfc16e18d835a33f0898c3e4df359c33d158c defaults
1⤵
- Modifies rc script
- Write file to user bin folder
PID:594
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:599

/usr/bin/kgtjvucfht
/usr/bin/kgtjvucfht "grep \"A\"" 590
1⤵
PID:620

/usr/bin/kgtjvucfht
/usr/bin/kgtjvucfht "grep \"A\"" 590
1⤵
PID:624

/usr/bin/kgtjvucfht
/usr/bin/kgtjvucfht gnome-terminal 590
1⤵
PID:627

/usr/bin/kgtjvucfht
/usr/bin/kgtjvucfht top 590
1⤵
PID:630

/usr/bin/kgtjvucfht
/usr/bin/kgtjvucfht "route -n" 590
1⤵
PID:633

/usr/bin/oqmvitedyf
/usr/bin/oqmvitedyf su 590
1⤵
PID:636

/usr/bin/oqmvitedyf
/usr/bin/oqmvitedyf "netstat -antop" 590
1⤵
PID:639

/usr/bin/oqmvitedyf
/usr/bin/oqmvitedyf whoami 590
1⤵
PID:642

/usr/bin/oqmvitedyf
/usr/bin/oqmvitedyf ls 590
1⤵
PID:645

/usr/bin/oqmvitedyf
/usr/bin/oqmvitedyf bash 590
1⤵
PID:648

/usr/bin/vssrnnsdgh
/usr/bin/vssrnnsdgh ls 590
1⤵
PID:651

/usr/bin/vssrnnsdgh
/usr/bin/vssrnnsdgh whoami 590
1⤵
PID:654

/usr/bin/vssrnnsdgh
/usr/bin/vssrnnsdgh "ps -ef" 590
1⤵
PID:657

/usr/bin/vssrnnsdgh
/usr/bin/vssrnnsdgh who 590
1⤵
PID:660

/usr/bin/vssrnnsdgh
/usr/bin/vssrnnsdgh "echo \"find\"" 590
1⤵
PID:663

/usr/bin/mrpjxomjel
/usr/bin/mrpjxomjel pwd 590
1⤵
PID:669

/usr/bin/mrpjxomjel
/usr/bin/mrpjxomjel top 590
1⤵
PID:672

/usr/bin/mrpjxomjel
/usr/bin/mrpjxomjel "echo \"find\"" 590
1⤵
PID:675

/usr/bin/nzratbtgbv
/usr/bin/nzratbtgbv "sleep 1" 590
1⤵
PID:690

/usr/bin/nzratbtgbv
/usr/bin/nzratbtgbv su 590
1⤵
PID:693

/usr/bin/qxpqxmavzg
/usr/bin/qxpqxmavzg who 590
1⤵
PID:698

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task

T1053

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads