Overview

overview

10

Static

static

10

bd353a2888...ae51d3

ubuntu-20.04-amd64

10

Analysis

  • max time kernel
    2s
  • max time network
    133s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240221-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    10-04-2024 13:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bd353a28886815f43fe71c561a027fdeff5cd83e17e2055c0e52bea344ae51d3

  • Size

    27KB

  • MD5

    80e6bfeec50096d9b1c222897f43bbea

  • SHA1

    f8715db0f879fa87abf2ff6ac5b2d25fe89ccdda

  • SHA256

    bd353a28886815f43fe71c561a027fdeff5cd83e17e2055c0e52bea344ae51d3

  • SHA512

    45a663b8b4a20843656c28064dd8d6bac5b6ce2485da8a8409bac58f6fb9533588ad37bf3e6e5a84caf37fe6d236e6a07340fd2cee0c346faaea9bd0e8e24d35

  • SSDEEP

    768:B4D/o+FMXrThYxtqZZT3K6bDRSD2PLhys0iFxxgd:c/o+FMXrThYxtWT3K6Ws0iFxxg

Score
10/10
bpfdoorbackdoor

Malware Config

Signatures

  • BPFDoor

    BPFDoor is an evasive Linux backdoor attributed to a Chinese threat actor called Red Menshen.

    backdoorbpfdoor
  • BPFDoor payload 1 IoCs
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/bd353a28886815f43fe71c561a027fdeff5cd83e17e2055c0e52bea344ae51d3
    /tmp/bd353a28886815f43fe71c561a027fdeff5cd83e17e2055c0e52bea344ae51d3
    1⤵
      PID:1463
      • /bin/sh
        sh -c "/bin/rm -f /var/lock/kdumpdb;/bin/cp /tmp/bd353a28886815f43fe71c561a027fdeff5cd83e17e2055c0e52bea344ae51d3 /var/lock/kdumpdb && /bin/chmod 755 /var/lock/kdumpdb && /var/lock/kdumpdb --init"
        2⤵
          PID:1464
          • /bin/rm
            /bin/rm -f /var/lock/kdumpdb
            3⤵
              PID:1465
            • /bin/cp
              /bin/cp /tmp/bd353a28886815f43fe71c561a027fdeff5cd83e17e2055c0e52bea344ae51d3 /var/lock/kdumpdb
              3⤵
              • Reads runtime system information
              PID:1468
            • /bin/chmod
              /bin/chmod 755 /var/lock/kdumpdb
              3⤵
                PID:1473
              • /var/lock/kdumpdb
                /var/lock/kdumpdb --init
                3⤵
                  PID:1474

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • /run/lock/kdumpdb
              Filesize

              27KB

              MD5

              80e6bfeec50096d9b1c222897f43bbea

              SHA1

              f8715db0f879fa87abf2ff6ac5b2d25fe89ccdda

              SHA256

              bd353a28886815f43fe71c561a027fdeff5cd83e17e2055c0e52bea344ae51d3

              SHA512

              45a663b8b4a20843656c28064dd8d6bac5b6ce2485da8a8409bac58f6fb9533588ad37bf3e6e5a84caf37fe6d236e6a07340fd2cee0c346faaea9bd0e8e24d35

              Download Submit