Overview

overview

10

Static

static

1

payload

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    0s
  • max time network
    131s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240226-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    05/04/2024, 09:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    payload
  • Size 7.0MB
  • Sample240405-ly3ghsha5v
  • SHA256 13d2a7961d5b7142cc4666f1997b0738d3bc4df904814febfed5c68c29e485d4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xzutilbackdoor

Malware Config

Signatures

  • XZUtil is a linux backdoor releated to the CVE-2024-3094. 1 IoCs
    backdoor
  • XZutil

    XZutil is a linux backdoor written in C++.

    backdoorxzutil
  • Writes file to tmp directory 22 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/payload
    /tmp/payload
    1⤵
    • Writes file to tmp directory
    PID:1576

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _bz2.cpython-311-x86_64-linux-gnu.so
        • Path /tmp/_MEIOi7Ipv/lib-dynload/_bz2.cpython-311-x86_64-linux-gnu.so
        • Size 27KB
        • SHA256 45cc2981a780005649a1e4e01fbff9f9ae13902044f05c7ca3fa29e53295ba6a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _codecs_cn.cpython-311-x86_64-linux-gnu.so
        • Path /tmp/_MEIOi7Ipv/lib-dynload/_codecs_cn.cpython-311-x86_64-linux-gnu.so
        • Size 150KB
        • SHA256 c3fcef08685fb434a2afa9b2c0a4d16bf8b99af4bab5fa6cbc88975a81d5c960
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _codecs_hk.cpython-311-x86_64-linux-gnu.so
        • Path /tmp/_MEIOi7Ipv/lib-dynload/_codecs_hk.cpython-311-x86_64-linux-gnu.so
        • Size 154KB
        • SHA256 d84e71d541b8d874fd33545d1a30ae6d4005f8bc8152ef1e0faf860106541f69
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _codecs_iso2022.cpython-311-x86_64-linux-gnu.so
        • Path /tmp/_MEIOi7Ipv/lib-dynload/_codecs_iso2022.cpython-311-x86_64-linux-gnu.so
        • Size 30KB
        • SHA256 f6f963b676ca0c52f2d7d3a5ba683dc200cab1f9cd8559bc8e26c8e452201217
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _codecs_jp.cpython-311-x86_64-linux-gnu.so
        • Path /tmp/_MEIOi7Ipv/lib-dynload/_codecs_jp.cpython-311-x86_64-linux-gnu.so
        • Size 266KB
        • SHA256 89e34da5295f3592f2e84018ae671b64d9bcb0139719a8116b5bc648a352a30b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _codecs_kr.cpython-311-x86_64-linux-gnu.so
        • Path /tmp/_MEIOi7Ipv/lib-dynload/_codecs_kr.cpython-311-x86_64-linux-gnu.so
        • Size 138KB
        • SHA256 c7c708ce8eff59e3cfacdd71055f096bba72c9579be59921f8b55396d3cfdf5f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _codecs_tw.cpython-311-x86_64-linux-gnu.so
        • Path /tmp/_MEIOi7Ipv/lib-dynload/_codecs_tw.cpython-311-x86_64-linux-gnu.so
        • Size 110KB
        • SHA256 707b0103bc647249ec287fc1ef0b497f170cf5be2a1d5f2441618e309adfd6fc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _contextvars.cpython-311-x86_64-linux-gnu.so
        • Path /tmp/_MEIOi7Ipv/lib-dynload/_contextvars.cpython-311-x86_64-linux-gnu.so
        • Size 14KB
        • SHA256 91acaede2223f824a791a23634ac200906d854376665f015fa3017d53c27de26
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.cpython-311-x86_64-linux-gnu.so
        • Path /tmp/_MEIOi7Ipv/lib-dynload/_ctypes.cpython-311-x86_64-linux-gnu.so
        • Size 132KB
        • SHA256 38caaa34806125e43ae5d8eabf20a4953288241152859b3d40d1145de0ca5a52
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _decimal.cpython-311-x86_64-linux-gnu.so
        • Path /tmp/_MEIOi7Ipv/lib-dynload/_decimal.cpython-311-x86_64-linux-gnu.so
        • Size 303KB
        • SHA256 53f5f45182319d17d724d24964ec113b7401f2158f666e626cb2844eb15068f5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _hashlib.cpython-311-x86_64-linux-gnu.so
        • Path /tmp/_MEIOi7Ipv/lib-dynload/_hashlib.cpython-311-x86_64-linux-gnu.so
        • Size 62KB
        • SHA256 0e9f6f21c764cbedee8aa9b8e5a96d9b5fa72ff8d5921f8dffc08ad626d7ab29
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.cpython-311-x86_64-linux-gnu.so
        • Path /tmp/_MEIOi7Ipv/lib-dynload/_lzma.cpython-311-x86_64-linux-gnu.so
        • Size 43KB
        • SHA256 219608dcc499a27728ada4773829098e16a9437a8cc778d496614f163b38e023
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _multibytecodec.cpython-311-x86_64-linux-gnu.so
        • Path /tmp/_MEIOi7Ipv/lib-dynload/_multibytecodec.cpython-311-x86_64-linux-gnu.so
        • Size 53KB
        • SHA256 195760adb09ae8ebf5f30693614f2d0ba72e4032cf63021ce2a37d8823efcfdf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _typing.cpython-311-x86_64-linux-gnu.so
        • Path /tmp/_MEIOi7Ipv/lib-dynload/_typing.cpython-311-x86_64-linux-gnu.so
        • Size 13KB
        • SHA256 4fd0ef7a112b0c651b7bb17d8fda80de717b52b5ec4dc88f5710229d020dd9aa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        resource.cpython-311-x86_64-linux-gnu.so
        • Path /tmp/_MEIOi7Ipv/lib-dynload/resource.cpython-311-x86_64-linux-gnu.so
        • Size 18KB
        • SHA256 68308d57e1f27b3a1f02e8a30b9296f065ad413f4c5e3431b9f2d541903fe56b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libbz2.so.1.0
        • Path /tmp/_MEIOi7Ipv/libbz2.so.1.0
        • Size 72KB
        • SHA256 beab0081229187c19bd128b29e0b7df49fb8a9eb5048a81e01aff750e8390187
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libcrypto.so.3
        • Path /tmp/_MEIOi7Ipv/libcrypto.so.3
        • Size 5.2MB
        • SHA256 3c1a03c495f1abaa390f8f7ed670a80f08ddc4fc48915ebf0633fa0f1e6d1c44
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libexpat.so.1
        • Path /tmp/_MEIOi7Ipv/libexpat.so.1
        • Size 170KB
        • SHA256 80b6ff17c18761318c5b3f2d65bbe0309dd2511f37d79233461c89ef59ec6f06
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi.so.8
        • Path /tmp/_MEIOi7Ipv/libffi.so.8
        • Size 46KB
        • SHA256 350a9ff172e18b4046a2ab05254ffcb3f6c2658c952da2dfb66f7ac8d3173894
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        liblzma.so.5
        • Path /tmp/_MEIOi7Ipv/liblzma.so.5
        • Size 241KB
        • SHA256 319feb5a9cddd81955d915b5632b4a5f8f9080281fb46e2f6d69d53f693c23ae
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libpython3.11.so.1.0
        • Path /tmp/_MEIOi7Ipv/libpython3.11.so.1.0
        • Size 7.4MB
        • SHA256 36e817506cf8b176e3913501c4c7c51c217d5a5322ffab8bfa09d00b6e33b2c4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libz.so.1
        • Path /tmp/_MEIOi7Ipv/libz.so.1
        • Size 118KB
        • SHA256 cea99d9c9cc83663b8b3f47f644fc322d1c48afb81e7609bc04f5bc03fb4abc9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download