9185192e5f29c65bce9a03ad4833fcf1e8fb9c172dfea031a4e668d1ef45904a

Analysis

max time kernel
154s
max time network
155s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20230831-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20230831-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
12/10/2023, 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x86
Size

54KB
MD5

3a6b1c0d678ef02a049b1a84cbdf8bc8
SHA1

da1e2e59de9ed1a1b78a40549fbed214e1310e92
SHA256

9185192e5f29c65bce9a03ad4833fcf1e8fb9c172dfea031a4e668d1ef45904a
SHA512

8a30358389599c078fcab3d47a39946bb761f082f920172805cc9d44d7193ee843bfebc3887476ef308f1531d6113ab467a0a8a6f16bb6a83769c79be86d97e0
SSDEEP

1536:JeESt/basV2rcZhG6+KN7TqOBlSR9zWOIaEjrqMW:JeESt/basVTgW7TqOBQRVtXESx

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (37066) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/bin/systemd	597	x86

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mv

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bin/systemd	sh

/tmp/x86
/tmp/x86
1⤵
- Changes its process name
PID:597
- /bin/sh
  sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /�z��qz��/tmp/x86 bin/systemd�z��; chmod 777 bin/systemd"
  2⤵
  - Writes file to tmp directory
  PID:598
- - /bin/rm
    rm -rf bin/systemd
    3⤵
    PID:599
- - /bin/mkdir
    mkdir bin
    3⤵
    - Reads runtime system information
    PID:600
- - /bin/mv
    mv "/�z��qz��/tmp/x86" "bin/systemd�z��"
    3⤵
    - Reads runtime system information
    PID:601
- - /bin/chmod
    chmod 777 bin/systemd
    3⤵
    PID:602

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads