132c2d111dc80c1076d9a0148d20b9e56ba3b130c15b249c56139505a5a84807

Resubmissions

02-11-2023 08:30

231102-kec7vabe32 7

02-11-2023 08:11

231102-j3c2babc67 7

13-08-2022 12:40

220813-pwnr5acdg5 5

Analysis

max time kernel
5s
max time network
483s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231026-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231026-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
02-11-2023 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aktiun
Size

7.9MB
MD5

f83d9b27b1062cac3fe4020da4d4cdd2
SHA1

2cae27073004b3ceb3015c9078583d83732a8dc7
SHA256

132c2d111dc80c1076d9a0148d20b9e56ba3b130c15b249c56139505a5a84807
SHA512

7b760225512c0d7bf71ac8f7b2fe9c0b519072dc07b316398eb507c4baab6f3a8e0cb034cd1ebf87f8b376cf675bb281e696861427155b9ab7f45b8db25c340f
SSDEEP

98304:myxFnU72dgT8oPzkzBq8Gwim73PlpfbINz/v5AHySM7VI:jU8oPG7INlj3y

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

aktiun

ioc pid process

/tmp/onefile_1548_1698910249_125215/aktiun 1549 aktiun

ioc	pid	process
/tmp/onefile_1548_1698910249_125215/aktiun	1549	aktiun

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

Processes:

aktiun

description	ioc	process
File opened for modification	/tmp/onefile_1548_1698910249_125215/_codecs_kr.so	aktiun
File opened for modification	/tmp/onefile_1548_1698910249_125215/libz.so.1	aktiun
File opened for modification	/tmp/onefile_1548_1698910249_125215/aktiun	aktiun
File opened for modification	/tmp/onefile_1548_1698910249_125215/_codecs_cn.so	aktiun
File opened for modification	/tmp/onefile_1548_1698910249_125215/_codecs_hk.so	aktiun
File opened for modification	/tmp/onefile_1548_1698910249_125215/_multibytecodec.so	aktiun
File opened for modification	/tmp/onefile_1548_1698910249_125215/_opcode.so	aktiun
File opened for modification	/tmp/onefile_1548_1698910249_125215/libexpat.so.1	aktiun
File opened for modification	/tmp/onefile_1548_1698910249_125215/_codecs_iso2022.so	aktiun
File opened for modification	/tmp/onefile_1548_1698910249_125215/_codecs_jp.so	aktiun
File opened for modification	/tmp/onefile_1548_1698910249_125215/_codecs_tw.so	aktiun

/tmp/aktiun
/tmp/aktiun
1⤵
- Writes file to tmp directory
PID:1548

/tmp/onefile_1548_1698910249_125215/aktiun
/tmp/aktiun
2⤵
- Executes dropped EXE
PID:1549

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/onefile_1548_1698910249_125215/_codecs_cn.so
Filesize
153KB

MD5
df123c01f79e9f367c3c39dc333da93f

SHA1
0ccec78a2b9247d2bd65f0c1c477c50f38a2baf8

SHA256
6d2ad6f345e42f396a938681498b6580f4b329afca9c0f44cc1937a45398f7db

SHA512
c2c67fafb9812e7b15895dd77f8c33e209b008be4b73a59645b3b9b111db5d712d5e82d433655c83690b69142d3b99631874d6535c6d4231eba604a851b3a772

Download Submit
/tmp/onefile_1548_1698910249_125215/_codecs_hk.so
Filesize
161KB

MD5
f0bbc8985639bac4a314a371536a4ed3

SHA1
6ca6e9c52ab1341210674684cac37afbf876c6c4

SHA256
7a949da1de589dd74cbbb723dbd4d0f5b1b05de567d171db0a33b3d39a2fd87d

SHA512
55b82403d6f8251f21c862c5a69ae3568010b188446e32c4cb56437e08b8486f0f5b317364ab87e8add65583a4066d420b54a1a5dd9d9497a0549eb421804f34

Download Submit
/tmp/onefile_1548_1698910249_125215/_codecs_iso2022.so
Filesize
33KB

MD5
9f19f6991f69ea1f8a5da1198e7da153

SHA1
8ae3b1570bcc1312c2f6896e636e200005bc4145

SHA256
f93e420d51d37b5a28dd26f447c3c98c035d6689719e9b278c16339544b2dbbd

SHA512
a4e186aac817642b6ee3ca41594a89a00a5f24e0f190bcb09fcc7ec389edc25d48a617ace83d751f7f40b9f76abb869702fa2fba03321f0b83ceffae8fe0f862

Download Submit
/tmp/onefile_1548_1698910249_125215/_codecs_jp.so
Filesize
269KB

MD5
81dbf53484aacfe0948bd4a8e3b3809c

SHA1
b075d541617632ff2d775d37959ff9ce36143f19

SHA256
11029301895613d9bb4adbc87d77ef3a9fe39bfa96866e6ccd9afeeb96ba854f

SHA512
738750ca0f245d018bed23e92b36c77079f6dac433a9ab2634935fa5260b507b4a8bb872cc308f844a5969480dc797fc7c3dc59d26decb40961e8320d7574c99

Download Submit
/tmp/onefile_1548_1698910249_125215/_codecs_kr.so
Filesize
141KB

MD5
2d1d890be3a0264d7bb905542c5f565a

SHA1
b3e305639b7fd07d49f3ef63feb4437fe7c8ee96

SHA256
2d1ea629d8231018cec23ccd59a9e019037f6bae9c77c8d826e32eacff095866

SHA512
ef81fafa87f67acf14e4034c97643982c8bbde7ec23cca52adbd53e36fe487c1227ee51d18d4dd54d641a917b7d9b172b1b5b58af43b97123299fd54a502739b

Download Submit
/tmp/onefile_1548_1698910249_125215/_codecs_tw.so
Filesize
113KB

MD5
2b1ce325ba4d30df8bffe921c7536722

SHA1
368596a45b391fd03b2dfbe009339ed685551436

SHA256
e7b8b2c4b5e8abc05b1c5109a42a6a2d633f32a0ac874780e917889b4e81dfcb

SHA512
4550a48c4cf14450a4975e767942a725ab0421f0f404ce348819c898178f19c5581d3f0a841e8ca2d643ed6d1fdf91c4653e82e801e96088f9f4fdce24dedd92

Download Submit
/tmp/onefile_1548_1698910249_125215/_multibytecodec.so
Filesize
56KB

MD5
7e4daca59f697c1e045f48b67c04c62f

SHA1
d716031bc9d82875204abab345f8a38c70bdba18

SHA256
07f1b9c7f668efaacc7805a479e3e18d30ea515c3d2309d04888b1e65c7ae2de

SHA512
9beda95acc614ec38f0943ccb6b439239c6a8053315d48c1d212caddbb2b0161ac458cbe303be31f7854c6d6de9248387e9cd546fd199ef34cd7a68d0e65f950

Download Submit
/tmp/onefile_1548_1698910249_125215/_opcode.so
Filesize
17KB

MD5
3cdb5d46290316a70acffd0f87608645

SHA1
db51ba27d8e367bf57c2815ac7eba30f53c0c9ea

SHA256
7f3ab30fa39fe258098417394c66378fa3035828d77e6c3f031e892f523cf3ac

SHA512
e6dab5e8c92e2bfc8e0367a987ce19b5fd19eacf000133e8140c4fa05d92c5f2056caf68a9d8c9b1b377b4376b83826df456bd781b928c8af844be4352cc4212

Download Submit
/tmp/onefile_1548_1698910249_125215/aktiun
Filesize
6.7MB

MD5
e204febe6a01f396b6701b7152a86dff

SHA1
0d95500b216e9f5951c0867c901fe5cf5e9a51de

SHA256
4cc7e91098a5c11761401aed911606d639e20ccf294cecbdb0819abb144d0538

SHA512
6641258639e10adecb742fd72654c7b39e2b15855d69fd829c99fc2ceb53cc6a2db480291ac9aef0e9e689ba09e41377fbfc56e0fd5daa1ae9d879a52db32ea9

Download Submit
/tmp/onefile_1548_1698910249_125215/libexpat.so.1
Filesize
186KB

MD5
d29571405111d21b2a1aaadddfd34d67

SHA1
4a5a91878a5198ef75ff6fee1c43bbf36846c300

SHA256
198d6dfa5d6fd59d2eabba74fdbed47f571c49d4effb697c4ec259044c91c04d

SHA512
4179834937aa274dce8665152e1bea47143bcc1b4e15aa5484f2c5846a2ea250cd382de951d88b1cb829965d9a574a15239fc5bd9848d17079289c4ee5d91bec

Download Submit
/tmp/onefile_1548_1698910249_125215/libz.so.1
Filesize
114KB

MD5
9665fe6dd3a7b7720416fe6bc7b69485

SHA1
1bfdd845b0e84c44dd47d6e7d50d0824c55f80a9

SHA256
a4c6b7e59cad863a9b90045942a0da3eefc481d4976a1b1e5723092d241dd115

SHA512
0a1b6738f05a030e41a790011b455cf08ceca765f3265da05a237e77c2d58a056a98b15ba26b2a62b310273ca7ea7f7d67260b48e8cca86fdb5ccda4c2e311bd

Download Submit