00fce8f5f6519d7b531cf4206b9a9ea1900ad371f5b339972b4bb718db51d376

max time kernel
8s
max time network
133s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
21/02/2024, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test/bin/lsusb
Size

1.1MB
MD5

991461b86aebecfd096dc11ff2a04b4b
SHA1

dc5074340d4631bbf89adc122e8f1a3ca8d87564
SHA256

dcd9a5af1c6297ed1a66c851efa305000335d8ade068ba515125a6612f1d5300
SHA512

8692fb03afbb9601444911167f579c23dfece59d04816b18591f7eb712572f63ce7b12e42dcc02f0e67110208f31f44501708f4b8d0fd8f20be6f1ea3bc0f3a5
SSDEEP

24576:qpLODejvoXyo2dIfScaxJZ7+0T8eaj+I++lZq49k77i:kLODe0XgdI83ak4/9k7u

Score

3^/10

Malware Config

Signatures

Writes file to tmp directory 64 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/test/bin/link
File opened for modification	/tmp/test/bin/logger
File opened for modification	/tmp/test/bin/mkfs.vfat
File opened for modification	/tmp/test/bin/mktemp
File opened for modification	/tmp/test/bin/mv
File opened for modification	/tmp/test/bin/svok
File opened for modification	/tmp/test/bin/tac
File opened for modification	/tmp/test/bin/loadfont
File opened for modification	/tmp/test/bin/losetup
File opened for modification	/tmp/test/bin/sysctl
File opened for modification	/tmp/test/bin/killall
File opened for modification	/tmp/test/bin/more
File opened for modification	/tmp/test/bin/mt
File opened for modification	/tmp/test/bin/stty
File opened for modification	/tmp/test/bin/loadkmap
File opened for modification	/tmp/test/bin/mim
File opened for modification	/tmp/test/bin/modprobe
File opened for modification	/tmp/test/bin/tc
File opened for modification	/tmp/test/bin/less
File opened for modification	/tmp/test/bin/logname
File opened for modification	/tmp/test/bin/logread
File opened for modification	/tmp/test/bin/mount
File opened for modification	/tmp/test/bin/swapon
File opened for modification	/tmp/test/bin/ls
File opened for modification	/tmp/test/bin/sulogin
File opened for modification	/tmp/test/bin/kbd_mode
File opened for modification	/tmp/test/bin/linux32
File opened for modification	/tmp/test/bin/lpd
File opened for modification	/tmp/test/bin/mkpasswd
File opened for modification	/tmp/test/bin/iptunnel
File opened for modification	/tmp/test/bin/mkdosfs
File opened for modification	/tmp/test/bin/modinfo
File opened for modification	/tmp/test/bin/strings
File opened for modification	/tmp/test/bin/syslogd
File opened for modification	/tmp/test/bin/tail
File opened for modification	/tmp/test/bin/tar
File opened for modification	/tmp/test/bin/killall5
File opened for modification	/tmp/test/bin/last
File opened for modification	/tmp/test/bin/linux64
File opened for modification	/tmp/test/bin/login
File opened for modification	/tmp/test/bin/switch_root
File opened for modification	/tmp/test/bin/taskset
File opened for modification	/tmp/test/bin/tcpsvd
File opened for modification	/tmp/test/bin/lpq
File opened for modification	/tmp/test/bin/mke2fs
File opened for modification	/tmp/test/bin/svlogd
File opened for modification	/tmp/test/bin/sync
File opened for modification	/tmp/test/bin/kill
File opened for modification	/tmp/test/bin/microcom
File opened for modification	/tmp/test/bin/mkdir
File opened for modification	/tmp/test/bin/mkfs.minix
File opened for modification	/tmp/test/bin/swapoff
File opened for modification	/tmp/test/bin/mkfifo
File opened for modification	/tmp/test/bin/mountpoint
File opened for modification	/tmp/test/bin/mpstat
File opened for modification	/tmp/test/bin/mknod
File opened for modification	/tmp/test/bin/mkswap
File opened for modification	/tmp/test/bin/sum
File opened for modification	/tmp/test/bin/iprule
File opened for modification	/tmp/test/bin/ln
File opened for modification	/tmp/test/bin/lpr
File opened for modification	/tmp/test/bin/mkfs.ext2
File opened for modification	/tmp/test/bin/su
File opened for modification	/tmp/test/bin/sv

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/test/bin/iproute

Filesize
1.1MB

MD5
991461b86aebecfd096dc11ff2a04b4b

SHA1
dc5074340d4631bbf89adc122e8f1a3ca8d87564

SHA256
dcd9a5af1c6297ed1a66c851efa305000335d8ade068ba515125a6612f1d5300

SHA512
8692fb03afbb9601444911167f579c23dfece59d04816b18591f7eb712572f63ce7b12e42dcc02f0e67110208f31f44501708f4b8d0fd8f20be6f1ea3bc0f3a5

Download Submit
/tmp/test/bin/last

Filesize
1.1MB

MD5
49a67c2b5b3fbd97fafd748746add379

SHA1
6396a85341bc5ff775f0ad429cee48e337852934

SHA256
3c6b95b13d824be66130b99052dd555cd3a8e7fc3f13d70cf3e4c32df0d2cbea

SHA512
f5a967cfc4922a411ac07f1d4ec56e23721b0d8720766c781f3bdf519ca2d4739acb7d4e6c79984dd81cd7df4c417fbcea96d98ba8e09f1255bcdf6b861c2286

Download Submit
/tmp/test/bin/less

Filesize
1.1MB

MD5
0a00a61dbcea26bcc00d2e0814e42842

SHA1
30c981d657331a41966ccbb9a2819868a3ad93f6

SHA256
c24f59670b2efcdbdeb11e89e0854986cdb6cfeae6755c0ae48b858514f7ff15

SHA512
9993839ed8cd8fa52fdb97deb7b111aafad6e98ce5da23fba146764166426d6ba108f6be0dfa9ba2d19ffcaf61e5417858604b96567496059828b845d88ff055

Download Submit
/tmp/test/bin/link

Filesize
1.1MB

MD5
41faccd9c28cdfaeced6fa8b0b979259

SHA1
3d4574b3e4d56423189c2c30c685aaee1ee99050

SHA256
df25ce17e515d73440a89604b1809a628b12e4fc15de5358b349bd89cab9f2e9

SHA512
7a53a8f09acd4db378cbac49df85f8bde34a31d57199a9fcd587073b602cddc1ec2511f68a75c82a7e23934f0ccaa14b1e259b2dcbf32bac014952c1c9054401

Download Submit
/tmp/test/bin/linux32

Filesize
480KB

MD5
3cab2c14cd30790a03d3de8eeea41f04

SHA1
fb21fbde73bed5355ecf0281083ef84e7f20f14c

SHA256
413acaabe27e638fa81c68007059e06c21dc5e23ddc4678f3a6a66f266918303

SHA512
e90d47c2f7a23774fd91c201a9a6cea5a432f8e9c3f707efaf3f6c18009b1e746e3f379741a9bddf6a62cc31ca8e43b0c1aa18de4fbd28e6115a6df363366dd3

Download Submit
/tmp/test/bin/linux64

Filesize
800KB

MD5
c75ea5e5757f014c7b640931a0723a8d

SHA1
362710784815c0630a5c0ecd96a50dba730ea958

SHA256
b777a74027c7d5b58ac5b3647600e9ecc2bdac03f5eb8e6a220904aee9aed9c1

SHA512
c0f0cbcccb91378b5af09048dc64c9d70c1c2fe99572bdd2986ef14f82ff5fd7f4213b865f2cd0cb9dfe6ba99804ce43fbac8f1250b1cccaf0e8b392d3185847

Download Submit
/tmp/test/bin/linuxrc

Filesize
1.1MB

MD5
ce262c78d14e6e32fd9daad98b8463a1

SHA1
ba9680fbb13105df63938ad1d2c1faa853e74d09

SHA256
be7740151982b879f62153e7a14f03d73e9faabd29c3f322677c785c751db3f6

SHA512
cf31ee6458c50f5b78ad58c92a2641af39ccc13a305cbb317e8990599126fa5ed1fe536f92059c9bae464024e61f99157c19d6d0e230e11915c3f49c008d91e7

Download Submit
/tmp/test/bin/ln

Filesize
1.1MB

MD5
250f7c27545f652dd3fbaa21cfeaddbe

SHA1
7e03a70039198638b0772b440f9ddbf49636197d

SHA256
d1ca97d235b6674ef7f91127c83aee58bf7f1f8d758db9d7fa534911f06d04b5

SHA512
226cc2bcaed23e0ccaef94e132c1f7853003c37cd9b38ad0d42dfd8a5bf8277331a3eb07bbe796b6ce4fb45813bad2aa678c5e3920946f191e7e7576b82f0b6c

Download Submit
/tmp/test/bin/loadfont

Filesize
256KB

MD5
068e4f5a81b9fc1fc6e9fe43e337cdf3

SHA1
0202476fa25b7924d614f77db60ece2100948cc3

SHA256
01c378a3e6bec6bf0823ebecbe795c942c7ef4e43b789ec268b97d7c12cec172

SHA512
ecdd2a768c6ddeff46ed1ad1db4f80a34e64a85b3a96c1445c2ba2a7448c968c9b80488c29e9dc9aa62b7dee9ed3e8d5968951e8a106edf81cc0c03c008ad346

Download Submit
/tmp/test/bin/loadkmap

Filesize
1.1MB

MD5
dc14982bc4c40a6697a28b354c416343

SHA1
817e4315920e10b7d71fc2e6f1ca1a7441e17bd8

SHA256
c7676d0e8fceceea7395da55e6bb4816c5aebab74b8c3f9bac6f0fdde30dbfd4

SHA512
bf2cbfa6f87d2ea4210fa4b9f93e0cbfb957b5bbe7201b5004bc0dcdf0fb0971aa6c5bf92a0c9be69eed80f0c9b3f53c9d8c0cd0719b06b51528006d99db6061

Download Submit
/tmp/test/bin/logger

Filesize
352KB

MD5
b6511c6089c1af5fbb3a58f40230852c

SHA1
b550668458e4a6688224e8e86112a287de53eff8

SHA256
3e1e2a33460f88d05fac1395c81d892a8cdc4982c885e098ac2be898813fff5c

SHA512
df6cd841058c334b24226a5d9325aa9e8c878d9ff8243f26638f11da11e0908f1a785ad2d4d2897f3956fe7a31e663c6614210293226c48c8ec93cc05cfbcf4e

Download Submit
/tmp/test/bin/login

Filesize
1.1MB

MD5
1a83d837b0566a6cec95514eb46dfe63

SHA1
af9a1f294164dff4b73ac36630a242816a59cf39

SHA256
0c55f9531f27bd6226dbd840969f3bd5211a88f3da9cb5848d80239de1441326

SHA512
52ad9323711f380dc03c2ed79a33d2f6cacec08fd9f4fdf71108cbea698c46e4d4129278e7ca21e54eca32b023c02d837ed8012478d04c5c5630f6e8da9300a2

Download Submit
/tmp/test/bin/lpr

Filesize
1.1MB

MD5
6670915bd9894edf26f7dd72a6ed0e2e

SHA1
f023d1093a302e9682f94f6ffd5aaf618fbd32a5

SHA256
7bb449216d3de85697284b8c20e7be7dc2ba029c4307bfc97b320a3c19ad9560

SHA512
82278398aa2123f6a46ffe4c39c2d4e9e7f32e00caae7b7812244aae4e1517eb6ea9c98a1c94c6066d31b6fb496f9ead1ee76c438063a94687726e7ef3442159

Download Submit
/tmp/test/bin/mkfifo

Filesize
1.1MB

MD5
11e5e3ca486c22173f41eca01b42420a

SHA1
1a6d81d304fe08b424ca3afe2356ffe25747861c

SHA256
106748b75d7f1ca028d19ed79d47cb2c034c41ad4356e4d8062d8b2a42913f0a

SHA512
46a4e16aae1d2ee8e00c1ccb4587f25fdf2133fa11750e621a182a969ba38d23c27ea7f041d0260bd4a73c320275b9809e9d8c13d7a0091024717add73464542

Download Submit
/tmp/test/bin/mkfs.ext2

Filesize
608KB

MD5
fe831383c6fd3207d8a8c96654f1d9d3

SHA1
1cafe505619e50e109ae3715387178a95fd2546c

SHA256
ba326581f1640debc85f46f9cd37feb1ec239e5fac1324f619cb228e134143a0

SHA512
c0813472dbf47bf3b78e1a31034fa768ef76cbc1ddc0de5f415a61625416d9d3d8d36fb8f3850a2b95817baee5a92c3d3053e414e26371fd2a683efb6a758f1b

Download Submit
/tmp/test/bin/more

Filesize
1.1MB

MD5
21fcc1529b020defe2d5d3755369ec43

SHA1
14f6287e07ce64ea2a6bbb2a72f40c5ab1bccdd0

SHA256
1ac4eda35cfb2926608beee6daba8d8188e395839009cb5090f5bc56aeb50d69

SHA512
67640b1afc84ca529d6eba63fe215ffd6d9ac6a0d9662d63912a0f23a286358c05426a95ef0cd281a8fec7160e422bff487a04034f4ce2b04a530a1a9299ffcf

Download Submit
/tmp/test/bin/mt

Filesize
1.0MB

MD5
05d673060e6407fd0fd0ea6e90993c5b

SHA1
a30600aa73295547d1d27e9717a30a8d3ea6e12e

SHA256
40c76264363262499e04f347eeabac4604f49856751c818539124760bc508174

SHA512
e621ad55a93b52d66597867a33f06a27e0079d7cb7ae0f9631f3baf1fb8079dc0d22b5c11fc568121aaf373e6a3b59ec835e2e66fb30cbb0ffc0c0aed867c093

Download Submit
/tmp/test/bin/su

Filesize
1.1MB

MD5
240a4f39968f4bd7658c097563835fec

SHA1
637337d1464196899db80719e81ccf601d9aa988

SHA256
1351f0b3cd873b4ffeddab683547c1ae1c8cdeb5dc097e6c9f4440a15280fb31

SHA512
23d3d1beed5c5613d15a632906b07b60dd2868dc902f18b4bbf57beeeaf0f0a74e969721b5e54514808b35a64cd3c0917b451fe31f46af239cf9736248723323

Download Submit
/tmp/test/bin/sulogin

Filesize
672KB

MD5
28fd3941b5247ebc1bcc7bcf61be46a5

SHA1
2467076599196934668926445a8bea3bd5b79086

SHA256
e337a3d2e5c58ee50d2fa478daf1342f85e489e34ec4eba90fc9825f75d8d61c

SHA512
a0b6ef29d84764ec06c2dcba769ff8a918bfa340b566773c20d68f23cfe57e983b5fcc6ff9097736ec5240b8914abbf5b599827279ba6f7bc5c487691b23bef7

Download Submit
/tmp/test/bin/swapoff

Filesize
640KB

MD5
76ecbc6b58e90cde790edd70cdd57e0b

SHA1
97f8ab50906535951bd4661c4bc38851a1a980cd

SHA256
10b1b9bebf04b1e0eadcb1f0bc70b08f5dcaef4407e23747de0dadae97be10d7

SHA512
f1415ae60fd42501ea4b6a4f9e2daca11234e687429a683fc0c634f3c69dab3df6e4a34adfcb8a7144c4ac745983168cee4e8b5407f4c78c9e24fe0f22f56e13

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads