5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5

Analysis

max time kernel
149s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231221-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231221-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20-02-2024 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
Size

1.8MB
MD5

0fec8e69d3f0c2ed1e277862ae11920a
SHA1

03ebe706b4db40f162a067faef9ae807a9a47112
SHA256

5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5
SHA512

15ff2439683ca1139c47ab3a95dc610ae75777304a1236e2a070da25054ae86ef519f85b8ddf19fc68d1cd52e824c25d8b42442c74034ca5130edb81a54f807c
SSDEEP

24576:ae9ufJvk4gQjMNRfktnsIXvZFyD9i+MPCIxyuzNqssZXJj1bdYVVMtIwWz1v:WYMnwRO4ssPVd5Wz1

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 5 IoCs

ioc	pid	Process
/etc/32676	1545	32676
/etc/opt.services.cfg	1632	opt.services.cfg
/etc/opt.services.cfg	1636	opt.services.cfg
/etc/opt.services.cfg	1651	opt.services.cfg
/etc/opt.services.cfg	1655	opt.services.cfg

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/etc/crontab	sh

Creates/modifies environment variables 1 TTPs 3 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/etc/profile.d/bash_cfg	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/profile.d/bash_cfg.sh	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/profile.d/gateway.sh	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 1 TTPs 34 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/init.d/dbus	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/keyboard-setup.sh	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/ssh	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/udev	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/uuidd	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/console-setup.sh	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/plymouth	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/selinux-autorelabel	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/avahi-daemon	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/cups-browsed	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/irqbalance	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/rsyslog	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/unattended-upgrades	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/cron	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/saned	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/speech-dispatcher	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/spice-vdagent	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/alsa-utils	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/auditd	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/bluetooth	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/hwclock.sh	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/apparmor	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/apport	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/cups	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/networking	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/x11-common	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/anacron	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/kmod	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/plymouth-log	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/rsync	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/ufw	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/gdm3	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/procps	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/init.d/acpid	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf

Write file to user bin folder 1 TTPs 4 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/include/find	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/usr/bin/include/lsof	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/usr/bin/find	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/usr/bin/lsof	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf

Modifies Bash startup script 1 TTPs 3 IoCs

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/profile.d/gateway.sh	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/profile.d/bash_cfg	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for modification	/etc/profile.d/bash_cfg.sh	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf

Enumerates kernel/hardware configuration 1 TTPs 6 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	opt.services.cfg
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	opt.services.cfg
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	opt.services.cfg
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	opt.services.cfg

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1148/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/10/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1439/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/36/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/460/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/1160/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/1255/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/22/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/516/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/1144/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/1534/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1327/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/24/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/26/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/1237/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1146/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/13/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/30/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/85/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/1059/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/1092/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/1140/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1143/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/23/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/1295/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/8/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/9/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1026/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1127/stat	5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
File opened for reading	/proc/cmdline	systemctl

/tmp/5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
/tmp/5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
1⤵
- Enumerates kernel/hardware configuration
PID:1536
- /tmp/5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf
  /tmp/5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5.elf " "
  2⤵
  - Creates/modifies environment variables
  - Modifies init.d
  - Write file to user bin folder
  - Modifies Bash startup script
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1540
- - /bin/sh
    /bin/sh -c "/etc/32676&"
    3⤵
    PID:1544
- - /usr/sbin/service
    service crond start
    3⤵
    PID:1546
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1548
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1549
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Reads runtime system information
      PID:1550
  - - /bin/systemctl
      systemctl -p Triggers show acpid.socket
      4⤵
      Reads runtime system information
      PID:1554
  - - /bin/systemctl
      systemctl -p Triggers show apport-forward.socket
      4⤵
      Reads runtime system information
      PID:1555
  - - /bin/systemctl
      systemctl -p Triggers show avahi-daemon.socket
      4⤵
      Reads runtime system information
      PID:1556
  - - /bin/systemctl
      systemctl -p Triggers show cups.socket
      4⤵
      Reads runtime system information
      PID:1557
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      PID:1559
  - - /bin/systemctl
      systemctl -p Triggers show saned.socket
      4⤵
      PID:1562
  - - /bin/systemctl
      systemctl -p Triggers show snapd.socket
      4⤵
      Reads runtime system information
      PID:1563
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      Reads runtime system information
      PID:1564
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      Reads runtime system information
      PID:1565
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      PID:1566
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      PID:1567
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      PID:1568
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      Reads runtime system information
      PID:1569
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      PID:1570
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      Reads runtime system information
      PID:1571
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      PID:1572
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      PID:1573
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      Reads runtime system information
      PID:1574
  - - /bin/systemctl
      systemctl -p Triggers show uuidd.socket
      4⤵
      Reads runtime system information
      PID:1575
- - /usr/local/sbin/systemctl
    systemctl start crond.service
    3⤵
    PID:1546
- - /usr/local/bin/systemctl
    systemctl start crond.service
    3⤵
    PID:1546
- - /usr/sbin/systemctl
    systemctl start crond.service
    3⤵
    PID:1546
- - /usr/bin/systemctl
    systemctl start crond.service
    3⤵
    PID:1546
- - /sbin/systemctl
    systemctl start crond.service
    3⤵
    PID:1546
- - /bin/systemctl
    systemctl start crond.service
    3⤵
    - Reads runtime system information
    PID:1546
- - /bin/sh
    /bin/sh -c "echo \"*/1 * * * * root /.mod \" >> /etc/crontab"
    3⤵
    - Creates/modifies Cron job
    PID:1576
- - /usr/bin/renice
    renice -20 1540
    3⤵
    PID:1577
- - /bin/mount
    mount -o bind /tmp/ /proc/1540
    3⤵
    PID:1578
- - /usr/sbin/service
    service cron start
    3⤵
    PID:1580
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1581
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1582
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      PID:1583
  - - /bin/systemctl
      systemctl -p Triggers show acpid.socket
      4⤵
      Reads runtime system information
      PID:1587
  - - /bin/systemctl
      systemctl -p Triggers show apport-forward.socket
      4⤵
      Reads runtime system information
      PID:1588
  - - /bin/systemctl
      systemctl -p Triggers show avahi-daemon.socket
      4⤵
      Reads runtime system information
      PID:1589
  - - /bin/systemctl
      systemctl -p Triggers show cups.socket
      4⤵
      PID:1590
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      PID:1591
  - - /bin/systemctl
      systemctl -p Triggers show saned.socket
      4⤵
      Reads runtime system information
      PID:1592
  - - /bin/systemctl
      systemctl -p Triggers show snapd.socket
      4⤵
      PID:1593
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      PID:1594
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      PID:1595
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      Reads runtime system information
      PID:1596
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      Reads runtime system information
      PID:1597
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      Reads runtime system information
      PID:1598
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      PID:1599
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      PID:1600
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      PID:1601
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      Reads runtime system information
      PID:1602
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      Reads runtime system information
      PID:1603
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      Reads runtime system information
      PID:1604
  - - /bin/systemctl
      systemctl -p Triggers show uuidd.socket
      4⤵
      Reads runtime system information
      PID:1605
- - /usr/local/sbin/systemctl
    systemctl start cron.service
    3⤵
    PID:1580
- - /usr/local/bin/systemctl
    systemctl start cron.service
    3⤵
    PID:1580
- - /usr/sbin/systemctl
    systemctl start cron.service
    3⤵
    PID:1580
- - /usr/bin/systemctl
    systemctl start cron.service
    3⤵
    PID:1580
- - /sbin/systemctl
    systemctl start cron.service
    3⤵
    PID:1580
- - /bin/systemctl
    systemctl start cron.service
    3⤵
    PID:1580
- - /bin/systemctl
    systemctl start crond.service
    3⤵
    PID:1606

/etc/32676
/etc/32676
1⤵
- Executes dropped EXE
PID:1545
- /bin/sleep
  sleep 60
  2⤵
  PID:1547
- /etc/opt.services.cfg
  /etc/opt.services.cfg
  2⤵
  - Executes dropped EXE
  - Enumerates kernel/hardware configuration
  PID:1632
- - /etc/opt.services.cfg
    /etc/opt.services.cfg " "
    3⤵
    - Executes dropped EXE
    - Enumerates kernel/hardware configuration
    PID:1636
- /bin/sleep
  sleep 60
  2⤵
  PID:1637
- /etc/opt.services.cfg
  /etc/opt.services.cfg
  2⤵
  - Executes dropped EXE
  - Enumerates kernel/hardware configuration
  PID:1651
- - /etc/opt.services.cfg
    /etc/opt.services.cfg " "
    3⤵
    - Executes dropped EXE
    - Enumerates kernel/hardware configuration
    PID:1655
- /bin/sleep
  sleep 60
  2⤵
  PID:1656

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:1553

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Reads runtime system information
PID:1552

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:1586

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Reads runtime system information
PID:1585

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Defense Evasion

Hijack Execution Flow

T1574

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/.mod

Filesize
34B

MD5
f5a3713282e43c200f30342f5ff5e2ea

SHA1
2b2ce1a207e2b691a074c6f78f71c4785aae426a

SHA256
6ab64e727571458d4884fb2fe82c27c467db0699cb8f648b3f0217c35d2b7511

SHA512
5bcb8cd360409147a486755f90e0cdd97183af02ce8de5135b7c6a8a010deb9ef12dcd5ee9a2a8fd2e159347f68e72d6b7fd75e943b4fcd928d7a74b97476013

Download Submit
/etc/.walk

Filesize
49B

MD5
54e6bd476c47b1a8f717f9fe77672c10

SHA1
f6f3cb9c57c5d8c62fada80b3fcf04797de6f45e

SHA256
2538d4094a17e503dfe2163a975ac55ca478ccd5e044b22587fd0427a202e1fb

SHA512
38f781fd6e9b149c5bb234ab75ea0658a2fa6b1f0cffb3f7c33d453001459828f2f4f17538a4a48120140566b9743ad7449cc1f38982cfc1b1110d8c65a92465

Download Submit
/etc/.walk

Filesize
98B

MD5
647a666c51eba93aa3ecb288d199b4d7

SHA1
4a83202ebb84a0642f4edde33539e249d0bf0e35

SHA256
da9273b5f3192c1ebe9e59144db3d5240b938b7fd13176a9a37642eb3f9b52cc

SHA512
043d7981cd08552d8c1f835b4a03eb8bc3663efed0972128a2d503f0216e7f105f9b85af757b680151adf16b27bf5847cf20c5cd5876b1c2ec84d119f1d7653d

Download Submit
/etc/32676

Filesize
61B

MD5
47684525bfdf26f49fd1cf742b17c015

SHA1
c4ab14ba22420ff9acadfc698a38d0cd99e9fbfa

SHA256
b7ce294613dd2c237a4a50548bfcd5c14d166107f2d2e965499bc78695300d5b

SHA512
948f9c519ae9afe1c821c5d58da2e584e50356dabef597ccd408853a9038560b9fb1c5894900e2725b48977ffd49d18a439436bb4946e2164ac9fcf2a8637621

Download Submit
/etc/opt.services.cfg

Filesize
1.8MB

MD5
0fec8e69d3f0c2ed1e277862ae11920a

SHA1
03ebe706b4db40f162a067faef9ae807a9a47112

SHA256
5e3ee5b0e30e13c3d3c6c2bef60fc12fbac929948e7b17cc2382ceea158116a5

SHA512
15ff2439683ca1139c47ab3a95dc610ae75777304a1236e2a070da25054ae86ef519f85b8ddf19fc68d1cd52e824c25d8b42442c74034ca5130edb81a54f807c

Download Submit
/etc/profile.d/gateway.sh

Filesize
1KB

MD5
fc5a2d602aa56dc9e63f1b105906f8cb

SHA1
b76d0e8a96654203030a36e66c66c668b8b64169

SHA256
1bced58d2009f2f570ec9711367c7efd3b9566f93943f211342f7c95c9403555

SHA512
08eccde7869be9a444db9e8a7a8d8f04a7fef9440e00b173fed4cf1bfa6916624919e286ce90529adb36c6ca86e9eff715dc7b6bc4b3172e879bd95362c764bf

Download Submit
/usr/bin/include/find

Filesize
232KB

MD5
f11b2b59639b1edcb46026472786c747

SHA1
a6fe59e11456bc7f19e28b38aa9c1f9c1a13b70d

SHA256
189fbf2416c8205430d8eaa85e2947bc15504ca335ad4a77ec668ff3cbf9c84a

SHA512
1967f43b4b274e2afbc30e8e1bad314085e488066b22233e6ec033dbae10ae111320296b9d429e94cb3079636a37e433aeac928b4ef23a56dedae1741815416b

Download Submit
/usr/bin/include/lsof

Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads