b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11

General

Target

b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf
Size

74KB
MD5

296cfde231042f4a645a26c25bf13a09
SHA1

a56da7a9c0511c08ab22bdf7d9f1ec0e1f6f7709
SHA256

b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11
SHA512

cc8996561ae9691bcb6ed2b57cd9926276d3d131794bcefffbb047b4956650111c853a3f8845c0dd9d2cfbda6de2d681f1fb5bcdfb1d23169482623e94015ab0
SSDEEP

1536:JEfduRD5QPhnK/toxtIpunxn6ksx2mPx7yGMRmINK1Ga8hWaLYXw5VR:UdkOPhoaxtzxn6GmJyRmT1GtWacA57

Score

7^/10

evasion

Malware Config

Signatures

Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
evasion

Indicator Removal
T1070

Processes:

b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf

description ioc process

File deleted /var/log/audit/audit.log b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf
Deletes itself 1 IoCs

Processes:

b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf

pid process

1479 b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf

description	ioc	process
File deleted	/var/log/audit/audit.log	b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf

pid	process
1479	b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf

Deletes journal logs 1 TTPs 1 IoCs

Deletes systemd journal logs. Likely to evade detection.

evasion

Indicator Removal

T1070

Processes:

b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf

description	ioc	process
File deleted	/var/log/journal/4816dd152e8c48ff97e9117d197c13d8/system.journal	b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf

Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
evasion

Indicator Removal
T1070

Processes:

b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf

description ioc process

File deleted /var/log/syslog b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf

description	ioc	process
File deleted	/var/log/syslog	b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf

description	ioc	process
File opened for modification	/dev/watchdog	b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf
File opened for modification	/dev/misc/watchdog	b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf

Deletes log files 1 TTPs 4 IoCs

Deletes log files on the system.

Indicator Removal

T1070

Processes:

b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf

description	ioc	process
File deleted	/var/log/auth.log	b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf
File deleted	/var/log/ubuntu-advantage.log	b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf
File deleted	/var/log/kern.log	b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf
File deleted	/var/log/apport.log	b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

Processes:

b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	vlgb1fijr5nrfgn0g5feg8om	1479	b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf

Reads CPU attributes 1 TTPs 10 IoCs

System Information Discovery

T1082

Processes:

pkillpkillpkillpkillpkillpkillpkillpkillpkillpkill

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pkillpkillpkillpkillpkillpkillpkillpkillpkillb6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elfpkill

description	ioc	process
File opened for reading	/proc/828/status	pkill
File opened for reading	/proc/1451/status	pkill
File opened for reading	/proc/1490/status	pkill
File opened for reading	/proc/1485/status	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/454/status	pkill
File opened for reading	/proc/483/cmdline	pkill
File opened for reading	/proc/1287/status	pkill
File opened for reading	/proc/1417/cmdline	pkill
File opened for reading	/proc/1486/cmdline	pkill
File opened for reading	/proc/84/status	pkill
File opened for reading	/proc/158/status	pkill
File opened for reading	/proc/301/cmdline	pkill
File opened for reading	/proc/438/cmdline	pkill
File opened for reading	/proc/514/cmdline	pkill
File opened for reading	/proc/930/status	pkill
File opened for reading	/proc/76/cmdline	pkill
File opened for reading	/proc/170/status	pkill
File opened for reading	/proc/777/status	pkill
File opened for reading	/proc/1050/status	pkill
File opened for reading	/proc/71/cmdline	pkill
File opened for reading	/proc/688/cmdline	pkill
File opened for reading	/proc/1182/status	pkill
File opened for reading	/proc/1492/cmdline	pkill
File opened for reading	/proc/self/auxv	pkill
File opened for reading	/proc/782/status	pkill
File opened for reading	/proc/945/status	pkill
File opened for reading	/proc/987/cmdline	pkill
File opened for reading	/proc/1287/cmdline	pkill
File opened for reading	/proc/777/cmdline	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/169/status	pkill
File opened for reading	/proc/688/status	pkill
File opened for reading	/proc/1075/status	pkill
File opened for reading	/proc/71/status	pkill
File opened for reading	/proc/163/status	pkill
File opened for reading	/proc/443/status	pkill
File opened for reading	/proc/201/cmdline	pkill
File opened for reading	/proc/666/status	pkill
File opened for reading	/proc/782/cmdline	pkill
File opened for reading	/proc/782/cmdline	pkill
File opened for reading	/proc/1071/status	pkill
File opened for reading	/proc/488/cmdline	pkill
File opened for reading	/proc/993/cmdline	b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf
File opened for reading	/proc/1396/cmdline	b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf
File opened for reading	/proc/1137/cmdline	b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf
File opened for reading	/proc/174/status	pkill
File opened for reading	/proc/301/cmdline	pkill
File opened for reading	/proc/443/status	pkill
File opened for reading	/proc/638/status	pkill
File opened for reading	/proc/1413/cmdline	pkill
File opened for reading	/proc/1488/status	pkill
File opened for reading	/proc/1062/cmdline	b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/439/cmdline	pkill
File opened for reading	/proc/453/status	pkill
File opened for reading	/proc/609/status	pkill
File opened for reading	/proc/1419/cmdline	pkill
File opened for reading	/proc/1424/cmdline	pkill
File opened for reading	/proc/1481/cmdline	pkill
File opened for reading	/proc/177/status	pkill
File opened for reading	/proc/666/cmdline	pkill
File opened for reading	/proc/1033/status	pkill

/tmp/b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf
/tmp/b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11.elf
1⤵
- Deletes Audit logs
- Deletes itself
- Deletes journal logs
- Deletes system logs
- Modifies Watchdog functionality
- Deletes log files
- Changes its process name
- Reads runtime system information
PID:1479

/usr/local/sbin/pkill
pkill wireshark
2⤵
PID:1483

/usr/local/bin/pkill
pkill wireshark
2⤵
PID:1483

/usr/sbin/pkill
pkill wireshark
2⤵
PID:1483

/usr/bin/pkill
pkill wireshark
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1483

/usr/local/sbin/pkill
pkill dumpcap
2⤵
PID:1484

/usr/local/bin/pkill
pkill dumpcap
2⤵
PID:1484

/usr/sbin/pkill
pkill dumpcap
2⤵
PID:1484

/usr/bin/pkill
pkill dumpcap
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1484

/usr/local/sbin/pkill
pkill tshark
2⤵
PID:1482

/usr/local/bin/pkill
pkill tshark
2⤵
PID:1482

/usr/local/sbin/pkill
pkill ettercap
2⤵
PID:1485

/usr/sbin/pkill
pkill tshark
2⤵
PID:1482

/usr/bin/pkill
pkill tshark
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1482

/usr/local/bin/pkill
pkill ettercap
2⤵
PID:1485

/usr/sbin/pkill
pkill ettercap
2⤵
PID:1485

/usr/local/sbin/pkill
pkill dsniff
2⤵
PID:1486

/usr/local/sbin/pkill
pkill tcpdump
2⤵
PID:1481

/usr/bin/pkill
pkill ettercap
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1485

/usr/local/bin/pkill
pkill dsniff
2⤵
PID:1486

/usr/local/sbin/pkill
pkill ngrep
2⤵
PID:1487

/usr/local/sbin/pkill
pkill tcpflow
2⤵
PID:1488

/usr/local/bin/pkill
pkill tcpdump
2⤵
PID:1481

/usr/sbin/pkill
pkill dsniff
2⤵
PID:1486

/usr/local/bin/pkill
pkill ngrep
2⤵
PID:1487

/usr/local/bin/pkill
pkill tcpflow
2⤵
PID:1488

/usr/bin/pkill
pkill dsniff
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1486

/usr/sbin/pkill
pkill tcpdump
2⤵
PID:1481

/usr/sbin/pkill
pkill ngrep
2⤵
PID:1487

/usr/bin/pkill
pkill tcpdump
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1481

/usr/sbin/pkill
pkill tcpflow
2⤵
PID:1488

/usr/bin/pkill
pkill ngrep
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1487

/usr/bin/pkill
pkill tcpflow
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1488

/usr/local/sbin/pkill
pkill windump
2⤵
PID:1489

/usr/local/bin/pkill
pkill windump
2⤵
PID:1489

/usr/sbin/pkill
pkill windump
2⤵
PID:1489

/usr/bin/pkill
pkill windump
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1489

/usr/local/sbin/pkill
pkill netsniff-ng
2⤵
PID:1490

/usr/local/bin/pkill
pkill netsniff-ng
2⤵
PID:1490

/usr/sbin/pkill
pkill netsniff-ng
2⤵
PID:1490

/usr/bin/pkill
pkill netsniff-ng
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1490

/usr/local/sbin/rm
rm -rf /usr/bin/ettercap
2⤵
PID:1509

/usr/local/bin/rm
rm -rf /usr/bin/ettercap
2⤵
PID:1509

/usr/sbin/rm
rm -rf /usr/bin/ettercap
2⤵
PID:1509

/usr/bin/rm
rm -rf /usr/bin/ettercap
2⤵
PID:1509

/usr/local/sbin/rm
rm -rf /usr/bin/dsniff
2⤵
PID:1510

/usr/local/bin/rm
rm -rf /usr/bin/dsniff
2⤵
PID:1510

/usr/sbin/rm
rm -rf /usr/bin/dsniff
2⤵
PID:1510

/usr/bin/rm
rm -rf /usr/bin/dsniff
2⤵
PID:1510

/usr/local/sbin/rm
rm -rf /usr/bin/ngrep
2⤵
PID:1511

/usr/local/bin/rm
rm -rf /usr/bin/ngrep
2⤵
PID:1511

/usr/sbin/rm
rm -rf /usr/bin/ngrep
2⤵
PID:1511

/usr/bin/rm
rm -rf /usr/bin/ngrep
2⤵
PID:1511

/usr/local/sbin/rm
rm -rf /usr/bin/tcpflow
2⤵
PID:1512

/usr/local/bin/rm
rm -rf /usr/bin/tcpflow
2⤵
PID:1512

/usr/sbin/rm
rm -rf /usr/bin/tcpflow
2⤵
PID:1512

/usr/bin/rm
rm -rf /usr/bin/tcpflow
2⤵
PID:1512

/usr/local/sbin/rm
rm -rf /usr/bin/netsniff-ng
2⤵
PID:1514

/usr/local/bin/rm
rm -rf /usr/bin/netsniff-ng
2⤵
PID:1514

/usr/sbin/rm
rm -rf /usr/bin/netsniff-ng
2⤵
PID:1514

/usr/bin/rm
rm -rf /usr/bin/netsniff-ng
2⤵
PID:1514

/usr/local/sbin/rm
rm -rf /usr/sbin/ngrep
2⤵
PID:1501

/usr/local/bin/rm
rm -rf /usr/sbin/ngrep
2⤵
PID:1501

/usr/sbin/rm
rm -rf /usr/sbin/ngrep
2⤵
PID:1501

/usr/bin/rm
rm -rf /usr/sbin/ngrep
2⤵
PID:1501

/usr/local/sbin/rm
rm -rf /usr/sbin/tcpflow
2⤵
PID:1502

/usr/local/bin/rm
rm -rf /usr/sbin/tcpflow
2⤵
PID:1502

/usr/sbin/rm
rm -rf /usr/sbin/tcpflow
2⤵
PID:1502

/usr/bin/rm
rm -rf /usr/sbin/tcpflow
2⤵
PID:1502

/usr/local/sbin/rm
rm -rf /usr/sbin/windump
2⤵
PID:1503

/usr/local/bin/rm
rm -rf /usr/sbin/windump
2⤵
PID:1503

/usr/sbin/rm
rm -rf /usr/sbin/windump
2⤵
PID:1503

/usr/bin/rm
rm -rf /usr/sbin/windump
2⤵
PID:1503

/usr/local/sbin/rm
rm -rf /usr/sbin/netsniff-ng
2⤵
PID:1504

/usr/local/bin/rm
rm -rf /usr/sbin/netsniff-ng
2⤵
PID:1504

/usr/sbin/rm
rm -rf /usr/sbin/netsniff-ng
2⤵
PID:1504

/usr/bin/rm
rm -rf /usr/sbin/netsniff-ng
2⤵
PID:1504

/usr/local/sbin/rm
rm -rf /usr/bin/tcpdump
2⤵
PID:1505

/usr/local/bin/rm
rm -rf /usr/bin/tcpdump
2⤵
PID:1505

/usr/sbin/rm
rm -rf /usr/bin/tcpdump
2⤵
PID:1505

/usr/bin/rm
rm -rf /usr/bin/tcpdump
2⤵
PID:1505

/usr/local/sbin/rm
rm -rf /usr/bin/tshark
2⤵
PID:1506

/usr/local/bin/rm
rm -rf /usr/bin/tshark
2⤵
PID:1506

/usr/sbin/rm
rm -rf /usr/bin/tshark
2⤵
PID:1506

/usr/bin/rm
rm -rf /usr/bin/tshark
2⤵
PID:1506

/usr/local/sbin/rm
rm -rf /usr/bin/wireshark
2⤵
PID:1507

/usr/local/bin/rm
rm -rf /usr/bin/wireshark
2⤵
PID:1507

/usr/sbin/rm
rm -rf /usr/bin/wireshark
2⤵
PID:1507

/usr/bin/rm
rm -rf /usr/bin/wireshark
2⤵
PID:1507

/usr/local/sbin/rm
rm -rf /usr/bin/dumpcap
2⤵
PID:1508

/usr/local/bin/rm
rm -rf /usr/bin/dumpcap
2⤵
PID:1508

/usr/sbin/rm
rm -rf /usr/bin/dumpcap
2⤵
PID:1508

/usr/bin/rm
rm -rf /usr/bin/dumpcap
2⤵
PID:1508

/usr/local/sbin/rm
rm -rf /usr/bin/windump
2⤵
PID:1513

/usr/local/bin/rm
rm -rf /usr/bin/windump
2⤵
PID:1513

/usr/sbin/rm
rm -rf /usr/bin/windump
2⤵
PID:1513

/usr/bin/rm
rm -rf /usr/bin/windump
2⤵
PID:1513

/usr/local/sbin/rm
rm -rf /usr/sbin/dsniff
2⤵
PID:1500

/usr/local/bin/rm
rm -rf /usr/sbin/dsniff
2⤵
PID:1500

/usr/sbin/rm
rm -rf /usr/sbin/dsniff
2⤵
PID:1500

/usr/bin/rm
rm -rf /usr/sbin/dsniff
2⤵
PID:1500

/usr/local/sbin/rm
rm -rf /usr/sbin/ettercap
2⤵
PID:1499

/usr/local/bin/rm
rm -rf /usr/sbin/ettercap
2⤵
PID:1499

/usr/sbin/rm
rm -rf /usr/sbin/ettercap
2⤵
PID:1499

/usr/bin/rm
rm -rf /usr/sbin/ettercap
2⤵
PID:1499

/usr/local/sbin/rm
rm -rf /usr/sbin/dumpcap
2⤵
PID:1498

/usr/local/bin/rm
rm -rf /usr/sbin/dumpcap
2⤵
PID:1498

/usr/sbin/rm
rm -rf /usr/sbin/dumpcap
2⤵
PID:1498

/usr/bin/rm
rm -rf /usr/sbin/dumpcap
2⤵
PID:1498

/usr/local/sbin/rm
rm -rf /usr/sbin/wireshark
2⤵
PID:1497

/usr/local/bin/rm
rm -rf /usr/sbin/wireshark
2⤵
PID:1497

/usr/sbin/rm
rm -rf /usr/sbin/wireshark
2⤵
PID:1497

/usr/bin/rm
rm -rf /usr/sbin/wireshark
2⤵
PID:1497

/usr/local/sbin/rm
rm -rf /usr/sbin/tshark
2⤵
PID:1496

/usr/local/bin/rm
rm -rf /usr/sbin/tshark
2⤵
PID:1496

/usr/sbin/rm
rm -rf /usr/sbin/tshark
2⤵
PID:1496

/usr/bin/rm
rm -rf /usr/sbin/tshark
2⤵
PID:1496

/usr/local/sbin/rm
rm -rf /usr/sbin/tcpdump
2⤵
PID:1495

/usr/local/bin/rm
rm -rf /usr/sbin/tcpdump
2⤵
PID:1495

/usr/sbin/rm
rm -rf /usr/sbin/tcpdump
2⤵
PID:1495

/usr/bin/rm
rm -rf /usr/sbin/tcpdump
2⤵
PID:1495

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

4

T1070

Impair Defenses

1

T1562

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads