129ff78e405aa6abe96453a2b480f446680f912f5512a9e0e67a15c871d3bfd5

Analysis

max time kernel
139s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20-12-2023 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fabdcc80bc425b814e83962d104eef6c
Size

7.0MB
MD5

fabdcc80bc425b814e83962d104eef6c
SHA1

e5f5b30c22051f8c37df092516c62f2aa86403b1
SHA256

129ff78e405aa6abe96453a2b480f446680f912f5512a9e0e67a15c871d3bfd5
SHA512

4609f13607b94b2f2d146019b55b827658bc4890e92e776a8c68d38a3a8a1cec2fa995594986ac2b2a8c53367a4111f0517069f0abe61cf645818f166ddfb1b4
SSDEEP

98304:n4qmZmgSoh0iDxpRqVlaCM/ieYCXfhxIX:4hZml0Dx3eeipCXZx

Score

6^/10

antivm persistence

Malware Config

Signatures

Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

catcat

description ioc process

File opened for reading /proc/cpuinfo cat
File opened for reading /proc/cpuinfo cat
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task/Job
T1053

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.i7C8tX crontab

description	ioc	process
File opened for reading	/proc/cpuinfo	cat
File opened for reading	/proc/cpuinfo	cat

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.i7C8tX	crontab

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

Processes:

fabdcc80bc425b814e83962d104eef6ccatfabdcc80bc425b814e83962d104eef6ccat

description	ioc	process
File opened for reading	/proc/sys/net/core/somaxconn	fabdcc80bc425b814e83962d104eef6c
File opened for reading	/proc/version	cat
File opened for reading	/proc/sys/net/core/somaxconn	fabdcc80bc425b814e83962d104eef6c
File opened for reading	/proc/version	cat

Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.

Processes:

description ioc

File opened for modification /tmp/nip9iNeiph5chee
File opened for modification /tmp/[stealth].pid
File opened for modification /tmp/.pid

description	ioc
File opened for modification	/tmp/nip9iNeiph5chee
File opened for modification	/tmp/[stealth].pid
File opened for modification	/tmp/.pid

/tmp/fabdcc80bc425b814e83962d104eef6c
/tmp/fabdcc80bc425b814e83962d104eef6c
1⤵
- Reads runtime system information
PID:1533

/bin/cat
cat /proc/version
1⤵
- Reads runtime system information
PID:1540

/bin/cat
cat /proc/cpuinfo
1⤵
- Checks CPU configuration
PID:1541

/bin/uname
uname -a
1⤵
PID:1543

/usr/bin/getconf
getconf LONG_BIT
1⤵
PID:1547

/tmp/fabdcc80bc425b814e83962d104eef6c
"[stealth]"
1⤵
- Reads runtime system information
PID:1548

/bin/cat
cat /proc/version
2⤵
- Reads runtime system information
PID:1551

/bin/cat
cat /proc/cpuinfo
1⤵
- Checks CPU configuration
PID:1553

/bin/uname
uname -a
1⤵
PID:1554

/usr/bin/getconf
getconf LONG_BIT
1⤵
PID:1555

/usr/bin/crontab
/usr/bin/crontab /tmp/nip9iNeiph5chee
1⤵
- Creates/modifies Cron job
PID:1556

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/.pid
Filesize
4B

MD5
35464c848f410e55a13bb9d78e7fddd0

SHA1
a575bcefdc7a11dec7302ce66652db242e7931ea

SHA256
48f31b127dde9f650b07d6d68488d734ed95687cbcfb2d06867d21ad0997f438

SHA512
1d0d7db8e07f74deab2c3b47c8bc683145a0a8ed486c65c19f0e43a62f283d69ff4ad586802d96b866ac836d0ff925b0e8de8e485c95473d044cec04edfede18

Download Submit
/var/spool/cron/crontabs/tmp.i7C8tX
Filesize
260B

MD5
ed3fe169a638c6cc3f6e21b54e9ff007

SHA1
8169455acf9769e6fae900f4bdab87a14777bed6

SHA256
eed2c24eb9cf0bb6419cb45456e0efda93f9292d68976d63ddc397ffbdc3d90c

SHA512
b69bf32777bb63d9fe19708725d5ebf71cc232f0cf0a0a0bcdf74b4555ab76784fe1961cd7d4d09279ee19231e39f95a340ca5045d038a62b5e0fc649fb19158

Download Submit