Analysis
-
max time kernel
150s -
max time network
157s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
-
submitted
20-12-2023 08:50
General
-
Target
97e4dbe4706e92a98d061b9c1a67a4ed
-
Size
7.0MB
-
MD5
97e4dbe4706e92a98d061b9c1a67a4ed
-
SHA1
0f9424e7cc5100015717c954eada312ab272320a
-
SHA256
85fcfc24c30cea3006d3001aef4e8c0fcd44743f7b2e3bf236402f964f71368b
-
SHA512
f6926c9d2a9a0c5e45c1fa06a23f6c48ef3ef9f71fb494c83e8ecb315834b9dc106377a9ca4f2f659f6f0d455625c95e905466371d1373ea246841167b98bdd2
-
SSDEEP
98304:K4qmZmgSoh0iDxpRqVlaCMiieYCXfhxIX:1hZml0Dx3enipCXZx
Malware Config
Signatures
-
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads runtime system information 4 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/97e4dbe4706e92a98d061b9c1a67a4ed/tmp/97e4dbe4706e92a98d061b9c1a67a4ed1⤵
- Reads runtime system information
-
/bin/catcat /proc/version2⤵
- Reads runtime system information
-
/bin/catcat /proc/cpuinfo1⤵
- Checks CPU configuration
-
/bin/unameuname -a1⤵
-
/usr/bin/getconfgetconf LONG_BIT1⤵
-
/tmp/97e4dbe4706e92a98d061b9c1a67a4ed"[stealth]"1⤵
- Reads runtime system information
-
/bin/catcat /proc/version2⤵
- Reads runtime system information
-
/bin/catcat /proc/cpuinfo1⤵
- Checks CPU configuration
-
/bin/unameuname -a1⤵
-
/usr/bin/getconfgetconf LONG_BIT1⤵
-
/usr/bin/crontab/usr/bin/crontab /tmp/nip9iNeiph5chee1⤵
- Creates/modifies Cron job
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/tmp/.pidFilesize
4B
MD5facf9f743b083008a894eee7baa16469
SHA1fe286d02f80118de47f2226c2fce9f7be0bc04f0
SHA2562163909115c0f6f1e638bd2c2279387cbe37cc327150a7b5cddfde3d1cd4ef0e
SHA5127bd3d1d347d68f23d612a3ec7a1d2f4094874162441bae20122876ea980bbb76a3c46d5d2e393975ea0659fb2b58046a311d7660f226482a57a74e9ffd9b0f36
-
/tmp/nip9iNeiph5cheeFilesize
66B
MD558a1f4e70f62d1aca14d8ffa827dc847
SHA126d6e02bc8a3918245d260f013c55f49afb4abde
SHA256d6863f074ea575971e608fa5c76dd5d2d48202762f7679c1647e478cfd4c80b4
SHA51282792311ddffe9e37c94c3f89764f54d69bf8ce491c1277827ad0e61fadea9caaf8b7fdb71c983bcb0e4242672c567f015b763ac7e8e37eb6b54ef3c2d5601b7
-
/var/spool/cron/crontabs/tmp.195dkrFilesize
260B
MD58027578d433498aaeeda329cab2adcc9
SHA1b1eaa8f4c338c1ea95fb86a777ea45e34f49dac1
SHA2566297bd568ec34487465f6cd3a732e8c7d59e3fd908ba2613d9dd778ac6b84773
SHA51228870688a726bb583337373b58267dee10f390affa65816ba14555f196c7b9d4b91e6efe5747ec7961a9a277b66dc56d78af3e4494c59fefbf644ce2f14f3a5d