2bbcf74d1e2397da9faee94501a7637c6041dc912ef3e5eb63da7a04d6bab799 | Triage

Analysis

max time kernel
11s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22/12/2023, 05:49

Sharing

Report Analysis Logs

General

Target

.sshv/su
Size

588B
MD5

9669407e2cd92b81a505a2513ec0c9c9
SHA1

2ad4fc5d7de1c7f0c5800839911f406cc30252e1
SHA256

39801769a453bf7aa33c51f6241825793b60fac03ae9d9d2179620044eba7f1f
SHA512

b43c65b7f906aed9e0351d2224c175a445c2a51c81ed1639484e8ef77ff421632994a8b1aafae43179345fe453aaaa9930bce86e6228e377332aca1f2170a945

Score

3^/10

Malware Config

Signatures

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/.sshv/scan.log
File opened for modification	/tmp/.sshv/t.log

/tmp/.sshv/su
/tmp/.sshv/su
1⤵
PID:1539
- /bin/sh
  sh test
  2⤵
  PID:1540
- /bin/rm
  rm -rf test
  2⤵
  PID:1541
- /bin/rm
  rm -rf scan.log
  2⤵
  PID:1542
- /bin/rm
  rm -rf "*.pscan*"
  2⤵
  PID:1543
- /bin/rm
  rm -rf vuln.txt
  2⤵
  PID:1544
- /bin/rm
  rm -rf nobash.txt
  2⤵
  PID:1545
- /bin/rm
  rm -rf t.log
  2⤵
  PID:1546
- /tmp/.sshv/ps
  ./ps 22
  2⤵
  PID:1547
- /bin/sleep
  sleep 3
  2⤵
  PID:1548
- /bin/cat
  cat .pscan.22
  2⤵
  PID:1552
- /usr/bin/sort
  sort
  2⤵
  PID:1553
- /usr/bin/uniq
  uniq
  2⤵
  PID:1554
- /tmp/.sshv/brute
  ./brute 100
  2⤵
  PID:1555
- /bin/sleep
  sleep 1
  2⤵
  PID:1556
- /usr/bin/which
  which replace
  2⤵
  PID:1567
- /bin/cat
  cat vuln.txt
  2⤵
  PID:1568
- /usr/bin/cut
  cut -d " " "-f1,2" "--output-d=:"
  2⤵
  PID:1569
- /bin/cat
  cat nobash.txt
  2⤵
  PID:1570
- /usr/bin/cut
  cut -d " " "-f1,2,3" "--output-d=:"
  2⤵
  PID:1571
- /tmp/.sshv/print
  ./print
  2⤵
  PID:1572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads