bf78a7986dc80e4d0b10b71b82eac24f792cfe50c14a71ff88354ab2a808f86e

Analysis

max time kernel
5s
max time network
132s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22-12-2023 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0c601b4dcbffb93a959f374f6379a1e
Size

451KB
MD5

f0c601b4dcbffb93a959f374f6379a1e
SHA1

aaf38919f0380467a0a5d2601e928cdc93451781
SHA256

bf78a7986dc80e4d0b10b71b82eac24f792cfe50c14a71ff88354ab2a808f86e
SHA512

712ecd9589a9b98ccb8ebc0be0db5aa951d8b1d7882ae46fdbfb9ea504999f07dfd83c544a2b120ba5957b543c99842a59bd491428b3c72d974c38da19c9416f
SSDEEP

6144:UIM21beIrQCxAeQmnT3V3xNNZkYgy2CZTLdUyhFe:ZdbeIrT9QmbVDNZkMZLdUqFe

Score

7^/10

Malware Config

Signatures

Traces itself 1 IoCs

Traces itself to prevent debugging attempts

pid
1543

Writes file to system bin folder 1 TTPs 30 IoCs

Hijack Execution Flow

T1574

description	ioc
File opened for modification	/bin/dnsdomainname
File opened for modification	/bin/chown
File opened for modification	/bin/bzgrep
File opened for modification	/bin/sh
File opened for modification	/bin/rbash
File opened for modification	/bin/lesspipe
File opened for modification	/bin/lsblk
File opened for modification	/bin/ntfsmove
File opened for modification	/bin/open
File opened for modification	/bin/gzip
File opened for modification	/bin/gunzip
File opened for modification	/bin/bzdiff
File opened for modification	/bin/run-parts
File opened for modification	/bin/systemd-machine-id-setup
File opened for modification	/bin/login
File opened for modification	/bin/wdctl
File opened for modification	/bin/lessfile
File opened for modification	/bin/chgrp
File opened for modification	/bin/ntfsls
File opened for modification	/bin/bunzip2
File opened for modification	/bin/busybox
File opened for modification	/bin/systemd
File opened for modification	/bin/ping4
File opened for modification	/bin/systemd-inhibit
File opened for modification	/bin/ntfsinfo
File opened for modification	/bin/dmesg
File opened for modification	/bin/zcmp
File opened for modification	/bin/false
File opened for modification	/bin/tempfile
File opened for modification	/bin/stty

Writes file to tmp directory 16 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/snap-private-tmp
File opened for modification	/tmp/ssh-b9TQnm02iuWq
File opened for modification	/tmp/.font-unix
File opened for modification	/tmp/systemd-private-c95e9585f00344709bd7a32ff2105b19-systemd-timedated.service-dc4C4o
File opened for modification	/tmp/.ICE-unix
File opened for modification	/tmp/.X11-unix
File opened for modification	/tmp/systemd-private-c95e9585f00344709bd7a32ff2105b19-ModemManager.service-lRRNOw
File opened for modification	/tmp/netplan_3zzsjbew
File opened for modification	/tmp/config-err-XtnKCW
File opened for modification	/tmp/.Test-unix
File opened for modification	/tmp/systemd-private-c95e9585f00344709bd7a32ff2105b19-systemd-resolved.service-vIWNpW
File opened for modification	/tmp/.XIM-unix
File opened for modification	/tmp/systemd-private-c95e9585f00344709bd7a32ff2105b19-fwupd.service-tDC6Ve
File opened for modification	/tmp/systemd-private-c95e9585f00344709bd7a32ff2105b19-colord.service-NARjPH
File opened for modification	/tmp/f0c601b4dcbffb93a959f374f6379a1e
File opened for modification	/tmp/systemd-private-c95e9585f00344709bd7a32ff2105b19-bolt.service-ZjEWpF

/tmp/f0c601b4dcbffb93a959f374f6379a1e
/tmp/f0c601b4dcbffb93a959f374f6379a1e
1⤵
PID:1542

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads