87a811d861febec0fe08a071d1d4d177601d641ce03e6efaf077b331d8f5c2d4

Resubmissions

05/03/2024, 14:21

240305-rpaysshg27 7

05/03/2024, 14:03

240305-rcpleshd65 7

Analysis

max time kernel
1s
max time network
184s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
05/03/2024, 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

update
Size

3.7MB
MD5

a34901f57fdafc1ba12e7f90d8707cca
SHA1

383f6dbabd90e768b14ae8d4d2bc6bae2749e399
SHA256

87a811d861febec0fe08a071d1d4d177601d641ce03e6efaf077b331d8f5c2d4
SHA512

a96621c56f8dae740c2484443afad5ea43978d1bfca7dd6efcd49d3e692259b3acfbb7a66dd6c2be608b2f112912ca3f15581e1ec2791b79f267bee78241bda8
SSDEEP

98304:lNk4JqZbxx/gMeJXDfyVcyz02OR1aBupiKQhseQ4Q8NOXm5xLLB:lsZbxyMsTdHanPh3B

Score

3^/10

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	update

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/version	update
File opened for reading	/proc/self/exe	update

/tmp/update
/tmp/update
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...