b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11

Reason

Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-25T19:55:53Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/ubuntu2004-amd64-20240221-en/instance_6-dirty.qcow2\"}"

General

Target

x86_64
Size

74KB
MD5

296cfde231042f4a645a26c25bf13a09
SHA1

a56da7a9c0511c08ab22bdf7d9f1ec0e1f6f7709
SHA256

b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11
SHA512

cc8996561ae9691bcb6ed2b57cd9926276d3d131794bcefffbb047b4956650111c853a3f8845c0dd9d2cfbda6de2d681f1fb5bcdfb1d23169482623e94015ab0
SSDEEP

1536:JEfduRD5QPhnK/toxtIpunxn6ksx2mPx7yGMRmINK1Ga8hWaLYXw5VR:UdkOPhoaxtzxn6GmJyRmT1GtWacA57

Score

7^/10

evasion

Malware Config

Signatures

Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
evasion

Indicator Removal
T1070

Processes:

x86_64

description ioc process

File deleted /var/log/audit/audit.log x86_64
Deletes itself 1 IoCs

Processes:

x86_64

pid process

1479 x86_64
Deletes journal logs 1 TTPs 1 IoCs
Deletes systemd journal logs. Likely to evade detection.
evasion

Indicator Removal
T1070

Processes:

x86_64

description ioc process

File deleted /var/log/journal/4816dd152e8c48ff97e9117d197c13d8/system.journal x86_64
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
evasion

Indicator Removal
T1070

Processes:

x86_64

description ioc process

File deleted /var/log/syslog x86_64
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Processes:

x86_64

description ioc process

File opened for modification /dev/watchdog x86_64
File opened for modification /dev/misc/watchdog x86_64

description	ioc	process
File deleted	/var/log/audit/audit.log	x86_64

pid	process
1479	x86_64

description	ioc	process
File deleted	/var/log/journal/4816dd152e8c48ff97e9117d197c13d8/system.journal	x86_64

description	ioc	process
File deleted	/var/log/syslog	x86_64

description	ioc	process
File opened for modification	/dev/watchdog	x86_64
File opened for modification	/dev/misc/watchdog	x86_64

Deletes log files 1 TTPs 4 IoCs

Deletes log files on the system.

Indicator Removal

T1070

Processes:

x86_64

description	ioc	process
File deleted	/var/log/apport.log	x86_64
File deleted	/var/log/auth.log	x86_64
File deleted	/var/log/Xorg.0.log	x86_64
File deleted	/var/log/kern.log	x86_64

Enumerates running processes
Discovers information about currently running processes on the system
Changes its process name 1 IoCs

Processes:

x86_64

description ioc pid process

Changes the process name, possibly in an attempt to hide itself vw4gd8a2fvqr1uj5hh3e 1479 x86_64

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	vw4gd8a2fvqr1uj5hh3e	1479	x86_64

Reads CPU attributes 1 TTPs 10 IoCs

System Information Discovery

T1082

Processes:

pkillpkillpkillpkillpkillpkillpkillpkillpkillpkill

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pkillpkillpkillpkillpkillpkillpkillpkillx86_64pkillpkill

description	ioc	process
File opened for reading	/proc/92/cmdline	pkill
File opened for reading	/proc/1102/cmdline	pkill
File opened for reading	/proc/1239/cmdline	pkill
File opened for reading	/proc/1478/cmdline	pkill
File opened for reading	/proc/1457/status	pkill
File opened for reading	/proc/73/cmdline	pkill
File opened for reading	/proc/159/status	pkill
File opened for reading	/proc/159/status	pkill
File opened for reading	/proc/502/status	pkill
File opened for reading	/proc/513/cmdline	pkill
File opened for reading	/proc/1086/status	pkill
File opened for reading	/proc/1104/cmdline	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/176/cmdline	pkill
File opened for reading	/proc/503/status	pkill
File opened for reading	/proc/1319/cmdline	pkill
File opened for reading	/proc/456/cmdline	pkill
File opened for reading	/proc/952/cmdline	pkill
File opened for reading	/proc/1181/status	pkill
File opened for reading	/proc/1309/cmdline	pkill
File opened for reading	/proc/89/status	pkill
File opened for reading	/proc/1030/cmdline	pkill
File opened for reading	/proc/1778/cmdline	x86_64
File opened for reading	/proc/274/cmdline	pkill
File opened for reading	/proc/513/status	pkill
File opened for reading	/proc/1040/status	pkill
File opened for reading	/proc/693/cmdline	pkill
File opened for reading	/proc/1048/cmdline	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/159/cmdline	pkill
File opened for reading	/proc/693/cmdline	pkill
File opened for reading	/proc/1480/status	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/999/status	pkill
File opened for reading	/proc/1048/cmdline	pkill
File opened for reading	/proc/1061/status	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/201/status	pkill
File opened for reading	/proc/968/cmdline	pkill
File opened for reading	/proc/1749/cmdline	x86_64
File opened for reading	/proc/1810/cmdline	x86_64
File opened for reading	/proc/458/status	pkill
File opened for reading	/proc/457/status	pkill
File opened for reading	/proc/1662/cmdline	x86_64
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/980/status	pkill
File opened for reading	/proc/265/cmdline	pkill
File opened for reading	/proc/166/status	pkill
File opened for reading	/proc/631/cmdline	pkill
File opened for reading	/proc/1052/status	pkill
File opened for reading	/proc/1052/cmdline	pkill
File opened for reading	/proc/1421/cmdline	x86_64
File opened for reading	/proc/1426/cmdline	pkill
File opened for reading	/proc/1480/cmdline	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/88/cmdline	pkill
File opened for reading	/proc/1040/cmdline	pkill
File opened for reading	/proc/974/status	pkill
File opened for reading	/proc/1140/cmdline	pkill
File opened for reading	/proc/1104/status	pkill
File opened for reading	/proc/1030/status	pkill
File opened for reading	/proc/1481/status	pkill
File opened for reading	/proc/24/status	pkill

/tmp/x86_64
/tmp/x86_64
1⤵
- Deletes Audit logs
- Deletes itself
- Deletes journal logs
- Deletes system logs
- Modifies Watchdog functionality
- Deletes log files
- Changes its process name
- Reads runtime system information
PID:1479

/usr/local/sbin/pkill
pkill tcpdump
2⤵
PID:1481

/usr/local/bin/pkill
pkill tcpdump
2⤵
PID:1481

/usr/sbin/pkill
pkill tcpdump
2⤵
PID:1481

/usr/bin/pkill
pkill tcpdump
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1481

/usr/local/sbin/pkill
pkill tshark
2⤵
PID:1482

/usr/local/sbin/pkill
pkill wireshark
2⤵
PID:1483

/usr/local/sbin/pkill
pkill dumpcap
2⤵
PID:1484

/usr/local/bin/pkill
pkill wireshark
2⤵
PID:1483

/usr/local/sbin/pkill
pkill dsniff
2⤵
PID:1486

/usr/local/sbin/pkill
pkill ettercap
2⤵
PID:1485

/usr/local/bin/pkill
pkill dumpcap
2⤵
PID:1484

/usr/sbin/pkill
pkill wireshark
2⤵
PID:1483

/usr/local/bin/pkill
pkill tshark
2⤵
PID:1482

/usr/local/bin/pkill
pkill dsniff
2⤵
PID:1486

/usr/bin/pkill
pkill wireshark
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1483

/usr/local/bin/pkill
pkill ettercap
2⤵
PID:1485

/usr/sbin/pkill
pkill tshark
2⤵
PID:1482

/usr/sbin/pkill
pkill dsniff
2⤵
PID:1486

/usr/local/sbin/pkill
pkill ngrep
2⤵
PID:1487

/usr/bin/pkill
pkill tshark
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1482

/usr/sbin/pkill
pkill ettercap
2⤵
PID:1485

/usr/bin/pkill
pkill dsniff
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1486

/usr/sbin/pkill
pkill dumpcap
2⤵
PID:1484

/usr/bin/pkill
pkill ettercap
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1485

/usr/bin/pkill
pkill dumpcap
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1484

/usr/local/bin/pkill
pkill ngrep
2⤵
PID:1487

/usr/sbin/pkill
pkill ngrep
2⤵
PID:1487

/usr/local/sbin/pkill
pkill tcpflow
2⤵
PID:1488

/usr/bin/pkill
pkill ngrep
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1487

/usr/local/bin/pkill
pkill tcpflow
2⤵
PID:1488

/usr/local/sbin/pkill
pkill windump
2⤵
PID:1489

/usr/sbin/pkill
pkill tcpflow
2⤵
PID:1488

/usr/bin/pkill
pkill tcpflow
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1488

/usr/local/bin/pkill
pkill windump
2⤵
PID:1489

/usr/local/sbin/pkill
pkill netsniff-ng
2⤵
PID:1490

/usr/sbin/pkill
pkill windump
2⤵
PID:1489

/usr/bin/pkill
pkill windump
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1489

/usr/local/bin/pkill
pkill netsniff-ng
2⤵
PID:1490

/usr/sbin/pkill
pkill netsniff-ng
2⤵
PID:1490

/usr/bin/pkill
pkill netsniff-ng
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1490

/usr/local/sbin/rm
rm -rf /usr/bin/ettercap
2⤵
PID:1512

/usr/local/sbin/rm
rm -rf /usr/bin/dsniff
2⤵
PID:1513

/usr/local/sbin/rm
rm -rf /usr/bin/ngrep
2⤵
PID:1514

/usr/local/sbin/rm
rm -rf /usr/bin/tcpflow
2⤵
PID:1515

/usr/local/sbin/rm
rm -rf /usr/bin/netsniff-ng
2⤵
PID:1517

/usr/local/sbin/rm
rm -rf /usr/sbin/ngrep
2⤵
PID:1504

/usr/local/sbin/rm
rm -rf /usr/sbin/tcpflow
2⤵
PID:1505

/usr/local/sbin/rm
rm -rf /usr/sbin/windump
2⤵
PID:1506

/usr/local/sbin/rm
rm -rf /usr/sbin/netsniff-ng
2⤵
PID:1507

/usr/local/sbin/rm
rm -rf /usr/bin/tcpdump
2⤵
PID:1508

/usr/local/sbin/rm
rm -rf /usr/bin/tshark
2⤵
PID:1509

/usr/local/sbin/rm
rm -rf /usr/bin/wireshark
2⤵
PID:1510

/usr/local/sbin/rm
rm -rf /usr/bin/dumpcap
2⤵
PID:1511

/usr/local/sbin/rm
rm -rf /usr/bin/windump
2⤵
PID:1516

/usr/local/sbin/rm
rm -rf /usr/sbin/dsniff
2⤵
PID:1503

/usr/local/bin/rm
rm -rf /usr/bin/tcpdump
2⤵
PID:1508

/usr/local/bin/rm
rm -rf /usr/bin/dsniff
2⤵
PID:1513

/usr/local/bin/rm
rm -rf /usr/sbin/windump
2⤵
PID:1506

/usr/local/bin/rm
rm -rf /usr/bin/windump
2⤵
PID:1516

/usr/local/bin/rm
rm -rf /usr/sbin/tcpflow
2⤵
PID:1505

/usr/local/bin/rm
rm -rf /usr/bin/wireshark
2⤵
PID:1510

/usr/local/bin/rm
rm -rf /usr/sbin/ngrep
2⤵
PID:1504

/usr/local/bin/rm
rm -rf /usr/sbin/netsniff-ng
2⤵
PID:1507

/usr/local/bin/rm
rm -rf /usr/bin/dumpcap
2⤵
PID:1511

/usr/local/bin/rm
rm -rf /usr/bin/ngrep
2⤵
PID:1514

/usr/local/bin/rm
rm -rf /usr/bin/netsniff-ng
2⤵
PID:1517

/usr/local/bin/rm
rm -rf /usr/bin/tcpflow
2⤵
PID:1515

/usr/local/bin/rm
rm -rf /usr/bin/ettercap
2⤵
PID:1512

/usr/local/bin/rm
rm -rf /usr/bin/tshark
2⤵
PID:1509

/usr/local/sbin/rm
rm -rf /usr/sbin/ettercap
2⤵
PID:1502

/usr/sbin/rm
rm -rf /usr/bin/wireshark
2⤵
PID:1510

/usr/sbin/rm
rm -rf /usr/bin/windump
2⤵
PID:1516

/usr/sbin/rm
rm -rf /usr/sbin/tcpflow
2⤵
PID:1505

/usr/local/bin/rm
rm -rf /usr/sbin/dsniff
2⤵
PID:1503

/usr/sbin/rm
rm -rf /usr/bin/dsniff
2⤵
PID:1513

/usr/sbin/rm
rm -rf /usr/sbin/netsniff-ng
2⤵
PID:1507

/usr/sbin/rm
rm -rf /usr/sbin/windump
2⤵
PID:1506

/usr/sbin/rm
rm -rf /usr/bin/dumpcap
2⤵
PID:1511

/usr/sbin/rm
rm -rf /usr/bin/tcpdump
2⤵
PID:1508

/usr/sbin/rm
rm -rf /usr/sbin/ngrep
2⤵
PID:1504

/usr/sbin/rm
rm -rf /usr/bin/netsniff-ng
2⤵
PID:1517

/usr/sbin/rm
rm -rf /usr/bin/tcpflow
2⤵
PID:1515

/usr/sbin/rm
rm -rf /usr/bin/ettercap
2⤵
PID:1512

/usr/sbin/rm
rm -rf /usr/bin/tshark
2⤵
PID:1509

/usr/bin/rm
rm -rf /usr/bin/windump
2⤵
PID:1516

/usr/sbin/rm
rm -rf /usr/bin/ngrep
2⤵
PID:1514

/usr/bin/rm
rm -rf /usr/sbin/tcpflow
2⤵
PID:1505

/usr/bin/rm
rm -rf /usr/bin/wireshark
2⤵
PID:1510

/usr/bin/rm
rm -rf /usr/sbin/netsniff-ng
2⤵
PID:1507

/usr/bin/rm
rm -rf /usr/bin/dsniff
2⤵
PID:1513

/usr/bin/rm
rm -rf /usr/bin/netsniff-ng
2⤵
PID:1517

/usr/bin/rm
rm -rf /usr/bin/tcpdump
2⤵
PID:1508

/usr/bin/rm
rm -rf /usr/sbin/windump
2⤵
PID:1506

/usr/bin/rm
rm -rf /usr/bin/dumpcap
2⤵
PID:1511

/usr/local/bin/rm
rm -rf /usr/sbin/ettercap
2⤵
PID:1502

/usr/bin/rm
rm -rf /usr/sbin/ngrep
2⤵
PID:1504

/usr/bin/rm
rm -rf /usr/bin/tshark
2⤵
PID:1509

/usr/bin/rm
rm -rf /usr/bin/tcpflow
2⤵
PID:1515

/usr/bin/rm
rm -rf /usr/bin/ettercap
2⤵
PID:1512

/usr/sbin/rm
rm -rf /usr/sbin/dsniff
2⤵
PID:1503

/usr/bin/rm
rm -rf /usr/bin/ngrep
2⤵
PID:1514

/usr/local/sbin/rm
rm -rf /usr/sbin/dumpcap
2⤵
PID:1501

/usr/bin/rm
rm -rf /usr/sbin/dsniff
2⤵
PID:1503

/usr/sbin/rm
rm -rf /usr/sbin/ettercap
2⤵
PID:1502

/usr/bin/rm
rm -rf /usr/sbin/ettercap
2⤵
PID:1502

/usr/local/bin/rm
rm -rf /usr/sbin/dumpcap
2⤵
PID:1501

/usr/sbin/rm
rm -rf /usr/sbin/dumpcap
2⤵
PID:1501

/usr/local/sbin/rm
rm -rf /usr/sbin/wireshark
2⤵
PID:1500

/usr/bin/rm
rm -rf /usr/sbin/dumpcap
2⤵
PID:1501

/usr/local/bin/rm
rm -rf /usr/sbin/wireshark
2⤵
PID:1500

/usr/sbin/rm
rm -rf /usr/sbin/wireshark
2⤵
PID:1500

/usr/bin/rm
rm -rf /usr/sbin/wireshark
2⤵
PID:1500

/usr/local/sbin/rm
rm -rf /usr/sbin/tshark
2⤵
PID:1499

/usr/local/bin/rm
rm -rf /usr/sbin/tshark
2⤵
PID:1499

/usr/sbin/rm
rm -rf /usr/sbin/tshark
2⤵
PID:1499

/usr/bin/rm
rm -rf /usr/sbin/tshark
2⤵
PID:1499

/usr/local/sbin/rm
rm -rf /usr/sbin/tcpdump
2⤵
PID:1498

/usr/local/bin/rm
rm -rf /usr/sbin/tcpdump
2⤵
PID:1498

/usr/sbin/rm
rm -rf /usr/sbin/tcpdump
2⤵
PID:1498

/usr/bin/rm
rm -rf /usr/sbin/tcpdump
2⤵
PID:1498

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

4

T1070

Impair Defenses

1

T1562

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads