a8accaab01a8ad16029ea0e8035a79083140026e33f8580aae217b1ef216febc

Analysis

max time kernel
96s
max time network
127s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20230621-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20230621-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
30-06-2023 12:51

Target

crp_linux_386
Size

4.5MB
MD5

461117f3dda072abc055ba080f6b21d4
SHA1

a43cb9204bc5e1b7efb97549715cb8152246e546
SHA256

a8accaab01a8ad16029ea0e8035a79083140026e33f8580aae217b1ef216febc
SHA512

c7cbc7c69e496588b75ff6fb70b5a5c059f7ebd2326229687c681e7e5c6049392691e0dc218c6288914b267dea14aaa541128dda7163938dbe85caa30140c052
SSDEEP

49152:vIPweIRiyshXMrzNEwVzZbW9teAJTwu7dXLcK/tCZ2kZLKYDsf8GulVkdkotl7qq:4TiNEYb0TwAXYKFCNLjDoM/i

Score

3^/10

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	crp_linux_386

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/crp_linux_386.pid	crp_linux_386

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact