d48be7caace50f53b8f826f907f60783e00631c54ed6667855dc598b011c4106

Analysis

max time kernel
212s
max time network
209s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20230831-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20230831-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
17/09/2023, 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

caido
Size

95.9MB
MD5

0f6c73e6b0176fb7375a2348c9b5ef20
SHA1

0fd582ed76284277f7a82d095b8b0d009ce3ed5b
SHA256

65954b0f35bcedb1a3388b4b9244a973f56b0f58815610cda19f8ba4ebe4416f
SHA512

011795e6e359d2d260e2c28657414f909b9e4579cf2efd987943bab9005d57bf544a8717b17b9d73fdc41aca0035fb0489a68d62d791af9d046671265923ef3c
SSDEEP

393216:5YgSodBrkkGX3g7nMXqUfnBNVvCk8d/r9X915hEdejqwZpusLcFSiWJxulNn+6Ud:5zFdBkgzMxPtvCk0/Rn5hy86UZ

Score

7^/10

antivm

Malware Config

Signatures

Changes its process name 11 IoCs

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	tracing-appende	600
Changes the process name, possibly in an attempt to hide itself	r2d2-worker-1	602
Changes the process name, possibly in an attempt to hide itself	r2d2-worker-0	601
Changes the process name, possibly in an attempt to hide itself	r2d2-worker-2	603
Changes the process name, possibly in an attempt to hide itself	blocking-1	608
Changes the process name, possibly in an attempt to hide itself	blocking-2	609
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	610
Changes the process name, possibly in an attempt to hide itself	blocking-3	611
Changes the process name, possibly in an attempt to hide itself	blocking-4	612
Changes the process name, possibly in an attempt to hide itself	actix-rt\|system	613
Changes the process name, possibly in an attempt to hide itself	actix-server ac	614

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	caido

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/maps	caido
File opened for reading	/proc/sys/kernel/osrelease	caido
File opened for reading	/proc/version	caido

/tmp/caido
/tmp/caido
1⤵
- Checks CPU configuration
- Reads runtime system information
PID:599
- /usr/local/sbin/xdg-open
  xdg-open http://127.0.0.1:8080/
  2⤵
  PID:615
- /usr/local/bin/xdg-open
  xdg-open http://127.0.0.1:8080/
  2⤵
  PID:615
- /usr/sbin/xdg-open
  xdg-open http://127.0.0.1:8080/
  2⤵
  PID:615
- /usr/bin/xdg-open
  xdg-open http://127.0.0.1:8080/
  2⤵
  PID:615
- /sbin/xdg-open
  xdg-open http://127.0.0.1:8080/
  2⤵
  PID:615
- /bin/xdg-open
  xdg-open http://127.0.0.1:8080/
  2⤵
  PID:615
- /usr/local/sbin/gio
  gio open http://127.0.0.1:8080/
  2⤵
  PID:616
- /usr/local/bin/gio
  gio open http://127.0.0.1:8080/
  2⤵
  PID:616
- /usr/sbin/gio
  gio open http://127.0.0.1:8080/
  2⤵
  PID:616
- /usr/bin/gio
  gio open http://127.0.0.1:8080/
  2⤵
  PID:616
- /sbin/gio
  gio open http://127.0.0.1:8080/
  2⤵
  PID:616
- /bin/gio
  gio open http://127.0.0.1:8080/
  2⤵
  PID:616
- /usr/local/sbin/gnome-open
  gnome-open http://127.0.0.1:8080/
  2⤵
  PID:617
- /usr/local/bin/gnome-open
  gnome-open http://127.0.0.1:8080/
  2⤵
  PID:617
- /usr/sbin/gnome-open
  gnome-open http://127.0.0.1:8080/
  2⤵
  PID:617
- /usr/bin/gnome-open
  gnome-open http://127.0.0.1:8080/
  2⤵
  PID:617
- /sbin/gnome-open
  gnome-open http://127.0.0.1:8080/
  2⤵
  PID:617
- /bin/gnome-open
  gnome-open http://127.0.0.1:8080/
  2⤵
  PID:617
- /usr/local/sbin/kde-open
  kde-open http://127.0.0.1:8080/
  2⤵
  PID:618
- /usr/local/bin/kde-open
  kde-open http://127.0.0.1:8080/
  2⤵
  PID:618
- /usr/sbin/kde-open
  kde-open http://127.0.0.1:8080/
  2⤵
  PID:618
- /usr/bin/kde-open
  kde-open http://127.0.0.1:8080/
  2⤵
  PID:618
- /sbin/kde-open
  kde-open http://127.0.0.1:8080/
  2⤵
  PID:618
- /bin/kde-open
  kde-open http://127.0.0.1:8080/
  2⤵
  PID:618

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.local/share/caido/config.db

Filesize
44KB

MD5
8c2df9d851c2566d796d0194f401c2e3

SHA1
94e35eb53b777fc653333ac8af57fc6c7bf96725

SHA256
8079ca52fc4ef452dc1d45c0499a3bed3a22ab7a7213dac47e574e552b7ac84e

SHA512
61b8292cf9b39acbebfdde495a85622e1e599e7d3c4b4271ffa7969090e86c03c7adf0e151998ab837dc8ac3b91e71cd177b4cd1bc48a6e6903d747b24598f2a

Download Submit
/root/.local/share/caido/logs/logging.2023-08-31.log

Filesize
4KB

MD5
a94c6b223792ed260f95e4ffec69cf0b

SHA1
f261f5aeb13bfc656828ec47e67cd1a4f34129d3

SHA256
dbd58ee1e006849320fc637d0f80699cf39190ead66429cedb863b916a332222

SHA512
42c4dca8d603e864e580d307cb966c01908e37e50ae071fb77e29115eca5df0a49a21a5451de26870bdd63646a31ecab7457633635d513b3faea5b3992e0982c

Download Submit
/root/.local/share/caido/secrets.db

Filesize
12KB

MD5
e599e881f5c612e53a784340edd94f72

SHA1
c1b4bd94ffb3292ee19b9d457f807422fd45ce2d

SHA256
ed59da2e05eef4a4e29287162e0e4cb7a574496d045d5ef52891c9ce7d584453

SHA512
4d5ca89bc1897203f9c04d4454cf953bacb7fbece3dd9e59dd1ea6e20f14eaf97d6d37dcc0b77c2053a3e2a6a9617b75d9b6c62368a353b83a1e24f9b2c811c6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads