Overview

overview

10

Static

static

10

xm.gz

windows7-x64

3

xm.gz

windows10-2004-x64

7

sample.tar

windows7-x64

3

sample.tar

windows10-2004-x64

7

aarch64

ubuntu-18.04-amd64

6

create

ubuntu-18.04-amd64

7

create

debian-9-armhf

7

create

debian-9-mips

1

create

debian-9-mipsel

1

hide

ubuntu-18.04-amd64

1

hide.c

windows7-x64

3

hide.c

windows10-2004-x64

3

init

ubuntu-18.04-amd64

3

mining

ubuntu-18.04-amd64

6

mining

debian-9-armhf

6

mining

debian-9-mips

6

mining

debian-9-mipsel

6

mkcfg

ubuntu-18.04-amd64

1

mkcfg

debian-9-armhf

1

mkcfg

debian-9-mips

1

mkcfg

debian-9-mipsel

1

start

ubuntu-18.04-amd64

10

start

debian-9-armhf

1

start

debian-9-mips

1

start

debian-9-mipsel

1

x86_64

ubuntu-18.04-amd64

6

Analysis

  • max time kernel
    14s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20231215-en
  • resource tags

    arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    20-12-2023 05:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    create

  • Size

    669B

  • MD5

    18d2b80638dc8ed90e86c7caf316fe43

  • SHA1

    887f50f37a7e57abd113153becd5d8e36a780b19

  • SHA256

    d6a88499031026e3216ac733dd5b6365d597fa91599d33ec10a65cbb72e229b8

  • SHA512

    1ab557c50377097f1b4f59bacea66de1b569ea8e341d47155919d2996157f71e078e3a4b474ef005c7320e4eb46199fdda01dcffe5df6973778059466c0f2cec

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 2 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/create
    /tmp/create
    1⤵
    • Writes file to tmp directory
    PID:665
    • /bin/cat
      cat auto
      2⤵
        PID:666
      • /usr/bin/crontab
        crontab cronjobs
        2⤵
        • Creates/modifies Cron job
        PID:669
      • /bin/rm
        rm -f cronjobs
        2⤵
          PID:684
        • /usr/bin/crontab
          crontab -l
          2⤵
          • Reads runtime system information
          PID:685
        • /bin/chmod
          chmod u+x auto init.d
          2⤵
            PID:687
          • /bin/sh
            sh -c "./auto > /dev/null 2>&1 &"
            2⤵
              PID:689
            • /bin/rm
              rm -f aarch64 x86_64 hide.c init.c start create
              2⤵
                PID:691
            • /tmp/auto
              ./auto
              1⤵
              • Executes dropped EXE
              • Writes file to tmp directory
              PID:690
              • /tmp/init.d
                /tmp/init.d
                2⤵
                  PID:693
                  • /tmp/init
                    ./init
                    3⤵
                      PID:695
                  • /bin/chmod
                    chmod 755 auto hide init init.d logs mining mkcfg systemd-private-4b192e10fe854c5f8803ee2d4da1ab24-systemd-timedated.service-MLzf3n
                    2⤵
                      PID:696
                    • /usr/bin/pkill
                      pkill -9 init
                      2⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:697
                  • /tmp/mining
                    ./mining
                    1⤵
                    • Writes file to tmp directory
                    PID:700
                    • /tmp/init
                      /tmp/init
                      2⤵
                        PID:703
                      • /bin/uname
                        uname -m
                        2⤵
                          PID:706
                        • /bin/ps
                          ps -ef
                          2⤵
                          • Reads CPU attributes
                          • Reads runtime system information
                          PID:708
                        • /bin/grep
                          grep "sendmail: accepting connections"
                          2⤵
                            PID:709
                          • /bin/grep
                            grep -v grep
                            2⤵
                              PID:710
                            • /usr/bin/awk
                              awk "{print \$2}"
                              2⤵
                                PID:711
                              • /usr/bin/head
                                head -1
                                2⤵
                                  PID:713

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • /tmp/auto
                                Filesize

                                5B

                                MD5

                                097306edbb9c640047927e86fadc1ae9

                                SHA1

                                a364b57e1a83551729cb4e170e562ebb0aaa6608

                                SHA256

                                1785cbdfcace2004c0d21cbc262071adf07ca0cd61f14fe5c66e737103025f3f

                                SHA512

                                60dd9daa455a8b636ce3cdf6a458d9151381c8de436e6197ed3a22c739bb893097abcf8728e61433ce9d2aece388aaff5a58405f85f956fc6c45c5f8e184e4df

                                Download Submit

                              • /tmp/auto
                                Filesize

                                197B

                                MD5

                                988b8163f85fc328dfacf8478e88b069

                                SHA1

                                0f862fb275a5755b112c426246300be43a1b34b9

                                SHA256

                                1f758502b2970809a3d695a41f21e73fb6b6ad372a744394aa24267efda6c26f

                                SHA512

                                449d4ac3876795b2727360edebd1e29c836a41397378a762758e1188c76629df4baeb2277e5b977f97efeb5dcca03503d350ce111eb8a292c9408dd73162ad8e

                                Download Submit

                              • /tmp/cronjobs
                                Filesize

                                36B

                                MD5

                                1d6269061b92bd8301a1ef18d77f11e5

                                SHA1

                                08125649ef9f58f504b4526530234d7512bab41e

                                SHA256

                                d2f5f29e60b1a7c23b311ae0f1c1c55d1e5bb4e116164ae31d27f172c985976d

                                SHA512

                                bd2134fefa6c84764ce74c1831fc90da81bebd8812229189f8f9899bca14d1b2c567d6f57f024786e3f170d7e27c8e8b98b4db1045d98d4db542b9ef7f8370c6

                                Download Submit

                              • /tmp/cronjobs
                                Filesize

                                76B

                                MD5

                                6103f8dacb16843a609dcb52eccc7f01

                                SHA1

                                409016664bb94e4c7d4728ff1f92c8a450cb6102

                                SHA256

                                47b3e37200c81a6f9d18803269d5c48410dc545d69e3216ea26c79393345de39

                                SHA512

                                19c69bd7c2ef044524550d6cdefb25c37652006305dc43b6214ae48565a6dc147aaa07f5a36110ebab2fc3c2efaee4e1adc34ffd45b48f88364a7de6de9ae5b3

                                Download Submit

                              • /var/spool/cron/crontabs/tmp.Ab6Wnh
                                Filesize

                                258B

                                MD5

                                11820917213d0c4250ce0afd05c842d7

                                SHA1

                                e8cd951792190632d1389db23fa1376e45fb6380

                                SHA256

                                8a7c3cc8a71aae5be8eef83ec6690bdf0dd85ae224cc043d4f420a614db4063a

                                SHA512

                                691872dfba9b90d0bf7214a83b16efc22d1c198c454260c7c1dce31bfc21c6dba36989efdc0b374b5863e0ac93b1a92858649393972aef09e93d71614f764a77

                                Download Submit