bb4c8ee23103cd57741a1008552dae1038c17c505dd16f80571d795d91892cad

Analysis

max time kernel
151s
max time network
153s
platform
linux_armhf
resource
debian9-armhf-en-20211208
resource tags

arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
15-05-2023 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eeccf51bb2274f325ca54ae3f9ebe857e0ddd6ab
Size

41KB
MD5

b9e02521a0bb96eb0528c170770a0c2d
SHA1

eeccf51bb2274f325ca54ae3f9ebe857e0ddd6ab
SHA256

bb4c8ee23103cd57741a1008552dae1038c17c505dd16f80571d795d91892cad
SHA512

6ecd57b14e5377c880d759979d0c3f461ed93a2f2c4ab69dfb3a550e973460e769c453d1ff38efe9d5e0c4aba43cddcf90bb5ff5a1e9b8dbb54095c3c688c6ba
SSDEEP

384:l0FINvSo5o/Ds3oIywe4Xz2Ye6rDBzgHZ4zRZn7hElu/tOJJJ2JJJuOfvuy/97MA:qCv3oIywe4Xz2YeIDBzgHShFMSZf

Score

7^/10

persistence

Malware Config

Signatures

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/usr/local/apache/bin/httpd -DSSL	355	eeccf51bb2274f325ca54ae3f9ebe857e0ddd6ab

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task

T1053

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.9ZQK6D	crontab

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	crontab

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/newcrontab	sh

/tmp/eeccf51bb2274f325ca54ae3f9ebe857e0ddd6ab
/tmp/eeccf51bb2274f325ca54ae3f9ebe857e0ddd6ab
1⤵
- Changes its process name
PID:355

sh
sh -c "echo '* * * * * /tmp/eeccf51bb2274f325ca54ae3f9ebe857e0ddd6ab' >> newcrontab ; crontab newcrontab; rm -fr newcrontab"
1⤵
- Writes file to tmp directory
PID:362
- crontab
  crontab newcrontab
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:363
- rm
  rm -fr newcrontab
  2⤵
  PID:364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/newcrontab

Filesize
56B

MD5
36a15ca328f6f858509d4c27ae7246ec

SHA1
7c279b68431e8fb049a5644dbf36dd1b0ace7b58

SHA256
53e802c281234769526fe2d9470664467f533d092c0126e423bedba7a7c6efbf

SHA512
568c11275e2240618b99924ff8416044d8e1a032e6a9a29d938850157923acf85e820cccd2125be938b9c1a30347919c552721d26dbe14e4f059af2a34dd400a

Download Submit
/var/spool/cron/crontabs/tmp.9ZQK6D

Filesize
240B

MD5
69a6abc426401005e6b3036b9575c4da

SHA1
71fffdcb7ee9b20954e5bdb6cf6543204ec69fca

SHA256
6716ce8c17e3774db619d896dce57db48f7fb9c10b508b4a669c7a01db40b52a

SHA512
211b789042b505d025aaa97b5eb322b8312ae5cb8fe85da09fb8b7251f775d04b9dcac3373fb66544168704a9f543921ec45f891853888359b15b394deb6c456

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads