Overview

overview

10

Static

static

10

156226c909...80f1f8

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    6s
  • max time network
    131s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20231215-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    30-12-2023 10:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    156226c90974180cc4b5f9738e80f1f8

  • Size

    27KB

  • MD5

    156226c90974180cc4b5f9738e80f1f8

  • SHA1

    ed0cd45c3bb95ef8da214048799395e247040d17

  • SHA256

    4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d

  • SHA512

    8915d1e0a42d8981b0260458a1d9769a29d45fcdd35f238caacbe7ffe8b6aa711c56c0b3afc550c0c33c58dc07ed0ba2444457dcc45665cb15d50f07fc9b82b6

  • SSDEEP

    768:vtDPYOFMXrThYxt+2ZcMyObDRSDfPrgd0iFngrJ+et:RPYOFMXrThYxttcMyOh0iFgrMe

Score
10/10
bpfdoorbackdoor

Malware Config

Signatures

  • BPFDoor

    BPFDoor is an evasive Linux backdoor attributed to a Chinese threat actor called Red Menshen.

    backdoorbpfdoor
  • BPFDoor payload 1 IoCs
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/156226c90974180cc4b5f9738e80f1f8
    /tmp/156226c90974180cc4b5f9738e80f1f8
    1⤵
      PID:1550
      • /bin/sh
        sh -c "/bin/rm -f /var/lock/kdumpflush;/bin/cp /tmp/156226c90974180cc4b5f9738e80f1f8 /var/lock/kdumpflush && /bin/chmod 755 /var/lock/kdumpflush && /var/lock/kdumpflush --init"
        2⤵
          PID:1551
          • /bin/rm
            /bin/rm -f /var/lock/kdumpflush
            3⤵
              PID:1552
            • /bin/cp
              /bin/cp /tmp/156226c90974180cc4b5f9738e80f1f8 /var/lock/kdumpflush
              3⤵
              • Reads runtime system information
              PID:1553
            • /bin/chmod
              /bin/chmod 755 /var/lock/kdumpflush
              3⤵
                PID:1554
              • /var/lock/kdumpflush
                /var/lock/kdumpflush --init
                3⤵
                  PID:1555

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • /run/lock/kdumpflush
              Filesize

              27KB

              MD5

              156226c90974180cc4b5f9738e80f1f8

              SHA1

              ed0cd45c3bb95ef8da214048799395e247040d17

              SHA256

              4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d

              SHA512

              8915d1e0a42d8981b0260458a1d9769a29d45fcdd35f238caacbe7ffe8b6aa711c56c0b3afc550c0c33c58dc07ed0ba2444457dcc45665cb15d50f07fc9b82b6

              Download Submit