6cb8da6b20d1ec5f2809819f1bd888bd2119d6c786d3361ebba38ce3cade6bd0

Analysis

max time kernel
125s
max time network
132s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
18/01/2024, 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6553e70962e9a1bc656627bc6df7c15a
Size

10.7MB
MD5

6553e70962e9a1bc656627bc6df7c15a
SHA1

68dcacf91d84d9d637fe7246550e24355465cf17
SHA256

6cb8da6b20d1ec5f2809819f1bd888bd2119d6c786d3361ebba38ce3cade6bd0
SHA512

08f2e1c0fbe34aac25fad4374824a94858af2e0a0006eb9abdc0abbfc0aa120e62f58d498d54e2f87880cad02ea2f012216acfe5146ca06acb2806174321731c
SSDEEP

196608:WCFJ1m1+iqjtJ9UE56rYdpZq8+ov3CkSlU6hoxJKD7cAvoXc9:WKJG+Dh5OYdrIKi/F

Score

6^/10

antivm evasion

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Reads hardware information 1 TTPs 3 IoCs

Accesses system info like serial numbers, manufacturer names etc.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/class/dmi/id/product_uuid	6553e70962e9a1bc656627bc6df7c15a
File opened for reading	/sys/class/dmi/id/product_uuid	6553e70962e9a1bc656627bc6df7c15a
File opened for reading	/sys/class/dmi/id/product_uuid	6553e70962e9a1bc656627bc6df7c15a

Reads list of loaded kernel modules 1 TTPs 1 IoCs

Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

evasion

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/modules

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	6553e70962e9a1bc656627bc6df7c15a
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	6553e70962e9a1bc656627bc6df7c15a
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	6553e70962e9a1bc656627bc6df7c15a

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/cpuset	6553e70962e9a1bc656627bc6df7c15a
File opened for reading	/proc/bus/pci/devices	Process not Found
File opened for reading	/proc/stat	Process not Found
File opened for reading	/proc/stat	6553e70962e9a1bc656627bc6df7c15a
File opened for reading	/proc/self/cpuset	6553e70962e9a1bc656627bc6df7c15a
File opened for reading	/proc/stat	6553e70962e9a1bc656627bc6df7c15a
File opened for reading	/proc/self/cpuset	6553e70962e9a1bc656627bc6df7c15a
File opened for reading	/proc/stat	6553e70962e9a1bc656627bc6df7c15a
File opened for reading	/proc/self/status	Process not Found
File opened for reading	/proc/self/cgroup	Process not Found

/tmp/6553e70962e9a1bc656627bc6df7c15a
/tmp/6553e70962e9a1bc656627bc6df7c15a
1⤵
- Reads hardware information
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1534
- /usr/bin/getconf
  /usr/bin/getconf CLK_TCK
  2⤵
  PID:1538
- /tmp/6553e70962e9a1bc656627bc6df7c15a
  /tmp/6553e70962e9a1bc656627bc6df7c15a
  2⤵
  - Reads hardware information
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1539
- - /usr/bin/getconf
    /usr/bin/getconf CLK_TCK
    3⤵
    PID:1546
- - /tmp/6553e70962e9a1bc656627bc6df7c15a
    /tmp/6553e70962e9a1bc656627bc6df7c15a
    3⤵
    - Reads hardware information
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1547
  - - /usr/bin/getconf
      /usr/bin/getconf CLK_TCK
      4⤵
      PID:1551

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads