2d9bb4e3fddfe5dc51c54cba74a1eb594c7be9d34774524d972350edd85e6499

Resubmissions

08-02-2024 01:32

240208-bx7pqsbg96 10

27-01-2024 14:19

240127-rmwgqadhc4 10

Analysis

max time kernel
157s
max time network
165s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
27-01-2024 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd013
Size

8.6MB
MD5

ae747bc7fff9bc23f06635ef60ea0e8d
SHA1

64315e834f67905ed4e47f36155362a78ac23462
SHA256

103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
SHA512

e24914a58565a43883c27ae4a41061e8edd3d5eef7b86c1c0e9910d9fbe0eef3e78ed49136ac0c9378311e99901b1847bcfd926aa9a3ea44149a7478480f82b2
SSDEEP

98304:rDSceJ/GqDu6P0ypQ0Qv5knSTH20ejwBcHjI7Xk:rDSceJ/GqD18RZv5knS720e7s

Score

8^/10

antivm persistence

Malware Config

Signatures

Adds new SSH keys 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
persistence

Processes:

description ioc

File opened for modification /root/.ssh/authorized_keys
Deletes itself 1 IoCs

Processes:

pid

1598
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

cat

description ioc process

File opened for reading /proc/cpuinfo cat
Deletes log files 1 TTPs 1 IoCs
Deletes log files on the system.

Indicator Removal
T1070

Processes:

description ioc

File deleted /var/log/tmp/The-MALWARE-Repo-master/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd013
Enumerates running processes
Discovers information about currently running processes on the system

description	ioc
File opened for modification	/root/.ssh/authorized_keys

pid
1598

description	ioc	process
File opened for reading	/proc/cpuinfo	cat

description	ioc
File deleted	/var/log/tmp/The-MALWARE-Repo-master/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd013

Reads CPU attributes 1 TTPs 21 IoCs

System Information Discovery

T1082

Processes:

pkillpspkillfreeuptimepsuptimefreepkillpspsfreepkillpkillpspspsuptimepkillpkillps

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pspskillallpskillallpskillallpkillpskillallkillallpkillkillallpspkillpidofkillallkillallpssudokillallsudopkillpkillpkillpskillallsudo

description	ioc	process
File opened for reading	/proc/stat	ps
File opened for reading	/proc/334/status	ps
File opened for reading	/proc/186/stat	killall
File opened for reading	/proc/957/cmdline	ps
File opened for reading	/proc/1375/status	ps
File opened for reading	/proc/1351/cmdline	killall
File opened for reading	/proc/334/stat	ps
File opened for reading	/proc/34/stat	ps
File opened for reading	/proc/1458/cmdline	ps
File opened for reading	/proc/682/cmdline	killall
File opened for reading	/proc/1111/cmdline	pkill
File opened for reading	/proc/1589/cmdline	ps
File opened for reading	/proc/1174/status	ps
File opened for reading	/proc/83/stat	killall
File opened for reading	/proc/546/cmdline	killall
File opened for reading	/proc/1210/stat	killall
File opened for reading	/proc/1152/cmdline	pkill
File opened for reading	/proc/1188/cmdline	ps
File opened for reading	/proc/173/cmdline	ps
File opened for reading	/proc/989/stat	killall
File opened for reading	/proc/1093/cmdline	ps
File opened for reading	/proc/79/stat	ps
File opened for reading	/proc/2/status	ps
File opened for reading	/proc/1278/stat	ps
File opened for reading	/proc/184/status	ps
File opened for reading	/proc/481/stat	killall
File opened for reading	/proc/1401/cmdline	ps
File opened for reading	/proc/577/cmdline	pkill
File opened for reading	/proc/1124/status	ps
File opened for reading	/proc/189/stat	pidof
File opened for reading	/proc/188/stat	killall
File opened for reading	/proc/98/stat	killall
File opened for reading	/proc/178/cmdline	pkill
File opened for reading	/proc/129/cmdline	ps
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/1111/cmdline	killall
File opened for reading	/proc/82/cmdline	pkill
File opened for reading	/proc/218/cmdline	ps
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/32/status	ps
File opened for reading	/proc/1458/status	ps
File opened for reading	/proc/184/status	ps
File opened for reading	/proc/682/stat	killall
File opened for reading	/proc/1111/cmdline	killall
File opened for reading	/proc/1124/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/1068/cmdline	ps
File opened for reading	/proc/1111/stat	killall
File opened for reading	/proc/89/stat	ps
File opened for reading	/proc/173/status	ps
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/492/cmdline	ps
File opened for reading	/proc/1062/cmdline	ps
File opened for reading	/proc/190/cmdline	pkill
File opened for reading	/proc/1591/status	pkill
File opened for reading	/proc/1602/stat	ps
File opened for reading	/proc/1615/stat	killall
File opened for reading	/proc/1361/cmdline	killall
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/1361/stat	killall

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

Processes:

touchtouch

description	ioc	process
File opened for modification	/tmp/The-MALWARE-Repo-master/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_24468	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_8899	touch

/tmp/The-MALWARE-Repo-master/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd013
/tmp/The-MALWARE-Repo-master/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd013
1⤵
PID:1595

/bin/uname
uname -a
1⤵
PID:1607

/bin/cat
cat /proc/cpuinfo
1⤵
- Checks CPU configuration
PID:1608

/bin/cat
cat /etc/issue
1⤵
PID:1609

/usr/bin/free
free -m
1⤵
- Reads CPU attributes
PID:1610

/usr/bin/uptime
uptime
1⤵
- Reads CPU attributes
PID:1611

/bin/journalctl
journalctl -S "@0" -u sshd
1⤵
PID:1612

/bin/cat
cat "/var/log/auth*"
1⤵
PID:1613

/bin/zcat
zcat "/var/log/auth*"
1⤵
PID:1614

/bin/gzip
gzip -cd "/var/log/auth*"
1⤵
PID:1614

/bin/bash
/bin/bash -
1⤵
PID:1615
- /usr/bin/sudo
  sudo -S touch .local_24468
  2⤵
  PID:1620
- - /usr/bin/touch
    touch .local_24468
    3⤵
    - Writes file to tmp directory
    PID:1621
- /usr/bin/sudo
  sudo rm .local_24468
  2⤵
  PID:1625
- - /bin/rm
    rm .local_24468
    3⤵
    PID:1626
- /usr/bin/sudo
  sudo killall -9 bssh
  2⤵
  PID:1633
- - /usr/bin/killall
    killall -9 bssh
    3⤵
    - Reads runtime system information
    PID:1634
- /usr/bin/sudo
  sudo rm -rf /tmp/.an
  2⤵
  PID:1635
- - /bin/rm
    rm -rf /tmp/.an
    3⤵
    PID:1636
- /usr/bin/sudo
  sudo killall -9 xm64
  2⤵
  PID:1637
- - /usr/bin/killall
    killall -9 xm64
    3⤵
    PID:1638
- /usr/bin/sudo
  sudo killall -9 rpc.idmapd
  2⤵
  PID:1639
- - /usr/bin/killall
    killall -9 rpc.idmapd
    3⤵
    - Reads runtime system information
    PID:1640
- /usr/bin/sudo
  sudo rm -rf /tmp/.m2
  2⤵
  PID:1641
- - /bin/rm
    rm -rf /tmp/.m2
    3⤵
    PID:1642
- /usr/bin/sudo
  sudo killall -9 xorgg
  2⤵
  PID:1643
- - /usr/bin/killall
    killall -9 xorgg
    3⤵
    - Reads runtime system information
    PID:1644
- /usr/bin/sudo
  sudo rm -rf /tmp/seconfig
  2⤵
  PID:1645
- - /bin/rm
    rm -rf /tmp/seconfig
    3⤵
    PID:1646
- /usr/bin/sudo
  sudo killall -9 crond64
  2⤵
  PID:1647
- - /usr/bin/killall
    killall -9 crond64
    3⤵
    - Reads runtime system information
    PID:1648
- /usr/bin/sudo
  sudo killall -9 tsm
  2⤵
  PID:1649
- - /usr/bin/killall
    killall -9 tsm
    3⤵
    PID:1650
- /usr/bin/sudo
  sudo rm -rf /tmp/.ssh
  2⤵
  PID:1651
- - /bin/rm
    rm -rf /tmp/.ssh
    3⤵
    PID:1652
- /usr/bin/sudo
  sudo rm -rf /tmp/.java
  2⤵
  PID:1653
- - /bin/rm
    rm -rf /tmp/.java
    3⤵
    PID:1654
- /usr/bin/sudo
  sudo rm -rf /tmp/.iolanda
  2⤵
  - Reads runtime system information
  PID:1655
- - /bin/rm
    rm -rf /tmp/.iolanda
    3⤵
    PID:1656
- /usr/bin/sudo
  sudo pkill test.mod
  2⤵
  PID:1657
- - /usr/bin/pkill
    pkill test.mod
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1658
- /usr/bin/sudo
  sudo pkill daemon.i686.mod
  2⤵
  PID:1659
- - /usr/bin/pkill
    pkill daemon.i686.mod
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1660
- /usr/bin/sudo
  sudo pkill daemon.armv4l.mod
  2⤵
  PID:1661
- - /usr/bin/pkill
    pkill daemon.armv4l.mod
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1662
- /usr/bin/sudo
  sudo pkill daemon.mips.mod
  2⤵
  PID:1663
- - /usr/bin/pkill
    pkill daemon.mips.mod
    3⤵
    - Reads CPU attributes
    PID:1664
- /usr/bin/sudo
  sudo pkill daemon.mipsel.mod
  2⤵
  PID:1665
- - /usr/bin/pkill
    pkill daemon.mipsel.mod
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1666
- /usr/bin/sudo
  sudo rm -rf /tmp/.xs
  2⤵
  - Reads runtime system information
  PID:1667
- - /bin/rm
    rm -rf /tmp/.xs
    3⤵
    PID:1668
- /usr/bin/sudo
  sudo pkill ld-linux-x86-64
  2⤵
  PID:1669
- - /usr/bin/pkill
    pkill ld-linux-x86-64
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1670
- /bin/rm
  rm -rf "/var/tmp/. *"
  2⤵
  PID:1671
- /usr/bin/sudo
  sudo killall -9 "[atd]"
  2⤵
  PID:1708
- - /usr/bin/killall
    killall -9 "[atd]"
    3⤵
    - Reads runtime system information
    PID:1711
- /usr/bin/sudo
  sudo rm -rf /tmp/.jk
  2⤵
  PID:1712
- - /bin/rm
    rm -rf /tmp/.jk
    3⤵
    PID:1713
- /usr/bin/sudo
  sudo killall -9 "[ntpd]"
  2⤵
  PID:1714
- - /usr/bin/killall
    killall -9 "[ntpd]"
    3⤵
    - Reads runtime system information
    PID:1715
- /usr/bin/sudo
  sudo killall -9 "[rpciod]"
  2⤵
  PID:1716
- - /usr/bin/killall
    killall -9 "[rpciod]"
    3⤵
    - Reads runtime system information
    PID:1717
- /usr/bin/sudo
  sudo killall -9 "[ext4-dio-unwrit]"
  2⤵
  PID:1718
- - /usr/bin/killall
    killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:1719
- /usr/bin/sudo
  sudo rm -rf "/tmp/.xm*"
  2⤵
  PID:1720
- - /bin/rm
    rm -rf "/tmp/.xm*"
    3⤵
    PID:1721
- /bin/pidof
  pidof libexec
  2⤵
  - Reads runtime system information
  PID:1722

/usr/bin/which
which sudo
1⤵
PID:1617

/usr/bin/wc
wc -l
1⤵
PID:1618

/bin/ls
ls -l .local_24468
1⤵
PID:1623

/bin/grep
grep -c root
1⤵
PID:1624

/usr/bin/sudo
sudo ps auxff
1⤵
PID:1628
- /bin/ps
  ps auxff
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1632

/bin/grep
grep "./crond -t=all"
1⤵
PID:1629

/bin/grep
grep -v grep
1⤵
PID:1630

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1631

/usr/bin/sudo
sudo ps auxf
1⤵
PID:1673
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1677

/bin/grep
grep xmr
1⤵
PID:1674

/bin/grep
grep -v grep
1⤵
PID:1675

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1676

/usr/bin/sudo
sudo ps auxf
1⤵
PID:1679
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1683

/bin/grep
grep cryptonight
1⤵
PID:1680

/bin/grep
grep -v grep
1⤵
PID:1681

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1682

/usr/bin/sudo
sudo ps auxf
1⤵
PID:1685
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1689

/bin/grep
grep stratum
1⤵
PID:1686

/bin/grep
grep -v grep
1⤵
PID:1687

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1688

/usr/bin/sudo
sudo ps auxf
1⤵
PID:1691
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1695

/bin/grep
grep dbus-daemon--system
1⤵
PID:1692

/bin/grep
grep -v grep
1⤵
PID:1693

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1694

/usr/bin/sudo
sudo ps auxf
1⤵
PID:1697
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1701

/bin/grep
grep "\\[\\]"
1⤵
PID:1698

/bin/grep
grep -v grep
1⤵
PID:1699

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1700

/usr/bin/sudo
sudo ps auxf
1⤵
PID:1703
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1707

/bin/grep
grep xm64
1⤵
PID:1704

/bin/grep
grep -v grep
1⤵
PID:1705

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1706

/usr/bin/free
free -m
1⤵
- Reads CPU attributes
PID:1709

/usr/bin/uptime
uptime
1⤵
- Reads CPU attributes
PID:1710

/bin/bash
/bin/bash -
1⤵
PID:1723
- /usr/bin/sudo
  sudo -S touch .local_8899
  2⤵
  PID:1728
- - /usr/bin/touch
    touch .local_8899
    3⤵
    - Writes file to tmp directory
    PID:1729
- /usr/bin/sudo
  sudo rm .local_8899
  2⤵
  PID:1733
- - /bin/rm
    rm .local_8899
    3⤵
    PID:1734
- /usr/bin/sudo
  sudo killall -9 bssh
  2⤵
  PID:1741
- - /usr/bin/killall
    killall -9 bssh
    3⤵
    PID:1742
- /usr/bin/sudo
  sudo rm -rf /tmp/.an
  2⤵
  PID:1743
- - /bin/rm
    rm -rf /tmp/.an
    3⤵
    PID:1744
- /usr/bin/sudo
  sudo killall -9 xm64
  2⤵
  PID:1745
- - /usr/bin/killall
    killall -9 xm64
    3⤵
    - Reads runtime system information
    PID:1746
- /usr/bin/sudo
  sudo killall -9 rpc.idmapd
  2⤵
  PID:1747
- - /usr/bin/killall
    killall -9 rpc.idmapd
    3⤵
    - Reads runtime system information
    PID:1748
- /usr/bin/sudo
  sudo rm -rf /tmp/.m2
  2⤵
  PID:1749
- - /bin/rm
    rm -rf /tmp/.m2
    3⤵
    PID:1750
- /usr/bin/sudo
  sudo killall -9 xorgg
  2⤵
  PID:1751
- - /usr/bin/killall
    killall -9 xorgg
    3⤵
    PID:1752
- /usr/bin/sudo
  sudo rm -rf /tmp/seconfig
  2⤵
  PID:1753
- - /bin/rm
    rm -rf /tmp/seconfig
    3⤵
    PID:1754
- /usr/bin/sudo
  sudo killall -9 crond64
  2⤵
  - Reads runtime system information
  PID:1755
- - /usr/bin/killall
    killall -9 crond64
    3⤵
    PID:1756
- /usr/bin/sudo
  sudo killall -9 tsm
  2⤵
  PID:1757
- - /usr/bin/killall
    killall -9 tsm
    3⤵
    - Reads runtime system information
    PID:1758
- /usr/bin/sudo
  sudo rm -rf /tmp/.ssh
  2⤵
  PID:1759
- - /bin/rm
    rm -rf /tmp/.ssh
    3⤵
    PID:1760
- /usr/bin/sudo
  sudo rm -rf /tmp/.java
  2⤵
  PID:1761
- - /bin/rm
    rm -rf /tmp/.java
    3⤵
    PID:1766
- /usr/bin/sudo
  sudo rm -rf /tmp/.iolanda
  2⤵
  PID:1767
- - /bin/rm
    rm -rf /tmp/.iolanda
    3⤵
    PID:1768
- /usr/bin/sudo
  sudo pkill test.mod
  2⤵
  PID:1769
- - /usr/bin/pkill
    pkill test.mod
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1770
- /usr/bin/sudo
  sudo pkill daemon.i686.mod
  2⤵
  PID:1771

/usr/bin/which
which sudo
1⤵
PID:1725

/usr/bin/wc
wc -l
1⤵
PID:1726

/bin/ls
ls -l .local_8899
1⤵
PID:1731

/bin/grep
grep -c root
1⤵
PID:1732

/usr/bin/sudo
sudo ps auxff
1⤵
PID:1736
- /bin/ps
  ps auxff
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1740

/bin/grep
grep "./crond -t=all"
1⤵
PID:1737

/bin/grep
grep -v grep
1⤵
PID:1738

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1739

/usr/bin/free
free -m
1⤵
- Reads CPU attributes
PID:1762

/usr/bin/uptime
uptime
1⤵
- Reads CPU attributes
PID:1765

/usr/bin/free
free -m
1⤵
PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.ssh/authorized_keys

Filesize
381B

MD5
9da18d38b6dd4c4aa84642378d63fa89

SHA1
c5a976691e4b5963b5e760044f22cc9685268db6

SHA256
43062900b2539d8d1f67f30fa7042c56b53541f63875b5f0de5d8fbde0e0a8bf

SHA512
222b20b5b2ff8956c13dbac1f8d3f81435613b751913d65f4c4082ea9c1a7c8ae91be17a24ef4ae0c708bfe09daab552bb209615714d70acfaaed89c536c71b3

Download Submit