b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11

General

Target

x86_64(1)
Size

74KB
MD5

296cfde231042f4a645a26c25bf13a09
SHA1

a56da7a9c0511c08ab22bdf7d9f1ec0e1f6f7709
SHA256

b6538d6af7fc74e1f6d2d49177df9d83debbf5972f485812f5811920fd86ca11
SHA512

cc8996561ae9691bcb6ed2b57cd9926276d3d131794bcefffbb047b4956650111c853a3f8845c0dd9d2cfbda6de2d681f1fb5bcdfb1d23169482623e94015ab0
SSDEEP

1536:JEfduRD5QPhnK/toxtIpunxn6ksx2mPx7yGMRmINK1Ga8hWaLYXw5VR:UdkOPhoaxtzxn6GmJyRmT1GtWacA57

Score

7^/10

evasion

Malware Config

Signatures

Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
evasion

Indicator Removal
T1070

Processes:

x86_64(1)

description ioc process

File deleted /var/log/audit/audit.log x86_64(1)
Deletes itself 1 IoCs

Processes:

x86_64(1)

pid process

1540 x86_64(1)
Deletes journal logs 1 TTPs 1 IoCs
Deletes systemd journal logs. Likely to evade detection.
evasion

Indicator Removal
T1070

Processes:

x86_64(1)

description ioc process

File deleted /var/log/journal/11c67417355f45d397f6be11f62e85a6/system.journal x86_64(1)
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
evasion

Indicator Removal
T1070

Processes:

x86_64(1)

description ioc process

File deleted /var/log/syslog x86_64(1)
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Processes:

x86_64(1)

description ioc process

File opened for modification /dev/watchdog x86_64(1)
File opened for modification /dev/misc/watchdog x86_64(1)
Deletes log files 1 TTPs 1 IoCs
Deletes log files on the system.

Indicator Removal
T1070

Processes:

x86_64(1)

description ioc process

File deleted /var/log/cups/error_log x86_64(1)
Enumerates running processes
Discovers information about currently running processes on the system
Changes its process name 1 IoCs

Processes:

x86_64(1)

description ioc pid process

Changes the process name, possibly in an attempt to hide itself ebualweajs4c8e64s2f8jbs8lqfd 1540 x86_64(1)

description	ioc	process
File deleted	/var/log/audit/audit.log	x86_64(1)

pid	process
1540	x86_64(1)

description	ioc	process
File deleted	/var/log/journal/11c67417355f45d397f6be11f62e85a6/system.journal	x86_64(1)

description	ioc	process
File deleted	/var/log/syslog	x86_64(1)

description	ioc	process
File opened for modification	/dev/watchdog	x86_64(1)
File opened for modification	/dev/misc/watchdog	x86_64(1)

description	ioc	process
File deleted	/var/log/cups/error_log	x86_64(1)

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	ebualweajs4c8e64s2f8jbs8lqfd	1540	x86_64(1)

Reads CPU attributes 1 TTPs 10 IoCs

System Information Discovery

T1082

Processes:

pkillpkillpkillpkillpkillpkillpkillpkillpkillpkill

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pkillpkillpkillpkillx86_64(1)pkillpkillpkillpkillpkillpkill

description	ioc	process
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/1141/status	pkill
File opened for reading	/proc/183/cmdline	pkill
File opened for reading	/proc/1314/status	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/178/status	pkill
File opened for reading	/proc/1129/cmdline	pkill
File opened for reading	/proc/7401/cmdline	x86_64(1)
File opened for reading	/proc/1105/status	pkill
File opened for reading	/proc/958/status	pkill
File opened for reading	/proc/4599/cmdline	x86_64(1)
File opened for reading	/proc/89/status	pkill
File opened for reading	/proc/184/cmdline	pkill
File opened for reading	/proc/213/cmdline	pkill
File opened for reading	/proc/1548/cmdline	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/176/status	pkill
File opened for reading	/proc/734/cmdline	pkill
File opened for reading	/proc/1543/status	pkill
File opened for reading	/proc/1535/cmdline	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/1141/cmdline	x86_64(1)
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/481/cmdline	pkill
File opened for reading	/proc/1125/cmdline	pkill
File opened for reading	/proc/8153/cmdline	x86_64(1)
File opened for reading	/proc/183/status	pkill
File opened for reading	/proc/610/status	pkill
File opened for reading	/proc/966/status	pkill
File opened for reading	/proc/1528/status	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/1178/status	pkill
File opened for reading	/proc/1191/cmdline	pkill
File opened for reading	/proc/1204/status	pkill
File opened for reading	/proc/1541/status	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/98/cmdline	pkill
File opened for reading	/proc/188/status	pkill
File opened for reading	/proc/188/cmdline	pkill
File opened for reading	/proc/1178/status	pkill
File opened for reading	/proc/1288/status	pkill
File opened for reading	/proc/1160/cmdline	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/664/status	pkill
File opened for reading	/proc/672/cmdline	pkill
File opened for reading	/proc/1137/cmdline	pkill
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/178/status	pkill
File opened for reading	/proc/1133/status	pkill
File opened for reading	/proc/1512/cmdline	x86_64(1)
File opened for reading	/proc/175/status	pkill
File opened for reading	/proc/14/cmdline	x86_64(1)
File opened for reading	/proc/2455/cmdline	x86_64(1)
File opened for reading	/proc/6424/cmdline	x86_64(1)
File opened for reading	/proc/184/status	pkill
File opened for reading	/proc/1133/status	pkill
File opened for reading	/proc/1201/status	pkill
File opened for reading	/proc/1201/status	pkill
File opened for reading	/proc/2879/cmdline	x86_64(1)
File opened for reading	/proc/83/status	pkill
File opened for reading	/proc/115/cmdline	pkill
File opened for reading	/proc/185/status	pkill

/tmp/x86_64(1)
"/tmp/x86_64(1)"
1⤵
- Deletes Audit logs
- Deletes itself
- Deletes journal logs
- Deletes system logs
- Modifies Watchdog functionality
- Deletes log files
- Changes its process name
- Reads runtime system information
PID:1540

/usr/local/sbin/pkill
pkill wireshark
2⤵
PID:1544

/usr/local/bin/pkill
pkill wireshark
2⤵
PID:1544

/usr/sbin/pkill
pkill wireshark
2⤵
PID:1544

/usr/bin/pkill
pkill wireshark
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1544

/usr/local/sbin/pkill
pkill tshark
2⤵
PID:1543

/usr/local/sbin/pkill
pkill ettercap
2⤵
PID:1546

/usr/local/sbin/pkill
pkill dsniff
2⤵
PID:1547

/usr/local/sbin/pkill
pkill ngrep
2⤵
PID:1548

/usr/local/bin/pkill
pkill ngrep
2⤵
PID:1548

/usr/sbin/pkill
pkill ngrep
2⤵
PID:1548

/usr/local/sbin/pkill
pkill tcpflow
2⤵
PID:1549

/usr/local/sbin/pkill
pkill windump
2⤵
PID:1550

/usr/bin/pkill
pkill ngrep
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1548

/usr/local/sbin/pkill
pkill netsniff-ng
2⤵
PID:1551

/usr/local/sbin/pkill
pkill dumpcap
2⤵
PID:1545

/usr/local/bin/pkill
pkill dumpcap
2⤵
PID:1545

/usr/sbin/pkill
pkill dumpcap
2⤵
PID:1545

/usr/local/bin/pkill
pkill ettercap
2⤵
PID:1546

/usr/bin/pkill
pkill dumpcap
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1545

/usr/local/bin/pkill
pkill tshark
2⤵
PID:1543

/usr/local/sbin/pkill
pkill tcpdump
2⤵
PID:1542

/usr/sbin/pkill
pkill ettercap
2⤵
PID:1546

/usr/sbin/pkill
pkill tshark
2⤵
PID:1543

/usr/bin/pkill
pkill ettercap
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1546

/usr/local/bin/pkill
pkill tcpdump
2⤵
PID:1542

/usr/bin/pkill
pkill tshark
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1543

/usr/sbin/pkill
pkill tcpdump
2⤵
PID:1542

/usr/bin/pkill
pkill tcpdump
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1542

/usr/local/bin/pkill
pkill dsniff
2⤵
PID:1547

/usr/sbin/pkill
pkill dsniff
2⤵
PID:1547

/usr/bin/pkill
pkill dsniff
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1547

/usr/local/bin/pkill
pkill tcpflow
2⤵
PID:1549

/usr/local/bin/pkill
pkill windump
2⤵
PID:1550

/usr/local/bin/pkill
pkill netsniff-ng
2⤵
PID:1551

/usr/sbin/pkill
pkill tcpflow
2⤵
PID:1549

/usr/sbin/pkill
pkill windump
2⤵
PID:1550

/usr/sbin/pkill
pkill netsniff-ng
2⤵
PID:1551

/usr/bin/pkill
pkill tcpflow
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1549

/usr/bin/pkill
pkill windump
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1550

/usr/bin/pkill
pkill netsniff-ng
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1551

/usr/local/sbin/rm
rm -rf /usr/bin/ettercap
2⤵
PID:1567

/usr/local/bin/rm
rm -rf /usr/bin/ettercap
2⤵
PID:1567

/usr/sbin/rm
rm -rf /usr/bin/ettercap
2⤵
PID:1567

/usr/bin/rm
rm -rf /usr/bin/ettercap
2⤵
PID:1567

/sbin/rm
rm -rf /usr/bin/ettercap
2⤵
PID:1567

/bin/rm
rm -rf /usr/bin/ettercap
2⤵
PID:1567

/usr/local/sbin/rm
rm -rf /usr/bin/dsniff
2⤵
PID:1568

/usr/local/bin/rm
rm -rf /usr/bin/dsniff
2⤵
PID:1568

/usr/sbin/rm
rm -rf /usr/bin/dsniff
2⤵
PID:1568

/usr/bin/rm
rm -rf /usr/bin/dsniff
2⤵
PID:1568

/sbin/rm
rm -rf /usr/bin/dsniff
2⤵
PID:1568

/bin/rm
rm -rf /usr/bin/dsniff
2⤵
PID:1568

/usr/local/sbin/rm
rm -rf /usr/bin/ngrep
2⤵
PID:1569

/usr/local/bin/rm
rm -rf /usr/bin/ngrep
2⤵
PID:1569

/usr/sbin/rm
rm -rf /usr/bin/ngrep
2⤵
PID:1569

/usr/bin/rm
rm -rf /usr/bin/ngrep
2⤵
PID:1569

/sbin/rm
rm -rf /usr/bin/ngrep
2⤵
PID:1569

/bin/rm
rm -rf /usr/bin/ngrep
2⤵
PID:1569

/usr/local/sbin/rm
rm -rf /usr/bin/tcpflow
2⤵
PID:1570

/usr/local/bin/rm
rm -rf /usr/bin/tcpflow
2⤵
PID:1570

/usr/sbin/rm
rm -rf /usr/bin/tcpflow
2⤵
PID:1570

/usr/bin/rm
rm -rf /usr/bin/tcpflow
2⤵
PID:1570

/sbin/rm
rm -rf /usr/bin/tcpflow
2⤵
PID:1570

/bin/rm
rm -rf /usr/bin/tcpflow
2⤵
PID:1570

/usr/local/sbin/rm
rm -rf /usr/bin/netsniff-ng
2⤵
PID:1572

/usr/local/bin/rm
rm -rf /usr/bin/netsniff-ng
2⤵
PID:1572

/usr/sbin/rm
rm -rf /usr/bin/netsniff-ng
2⤵
PID:1572

/usr/bin/rm
rm -rf /usr/bin/netsniff-ng
2⤵
PID:1572

/sbin/rm
rm -rf /usr/bin/netsniff-ng
2⤵
PID:1572

/bin/rm
rm -rf /usr/bin/netsniff-ng
2⤵
PID:1572

/usr/local/sbin/rm
rm -rf /usr/sbin/ngrep
2⤵
PID:1559

/usr/local/bin/rm
rm -rf /usr/sbin/ngrep
2⤵
PID:1559

/usr/sbin/rm
rm -rf /usr/sbin/ngrep
2⤵
PID:1559

/usr/bin/rm
rm -rf /usr/sbin/ngrep
2⤵
PID:1559

/sbin/rm
rm -rf /usr/sbin/ngrep
2⤵
PID:1559

/bin/rm
rm -rf /usr/sbin/ngrep
2⤵
PID:1559

/usr/local/sbin/rm
rm -rf /usr/sbin/tcpflow
2⤵
PID:1560

/usr/local/bin/rm
rm -rf /usr/sbin/tcpflow
2⤵
PID:1560

/usr/sbin/rm
rm -rf /usr/sbin/tcpflow
2⤵
PID:1560

/usr/bin/rm
rm -rf /usr/sbin/tcpflow
2⤵
PID:1560

/sbin/rm
rm -rf /usr/sbin/tcpflow
2⤵
PID:1560

/bin/rm
rm -rf /usr/sbin/tcpflow
2⤵
PID:1560

/usr/local/sbin/rm
rm -rf /usr/sbin/windump
2⤵
PID:1561

/usr/local/bin/rm
rm -rf /usr/sbin/windump
2⤵
PID:1561

/usr/sbin/rm
rm -rf /usr/sbin/windump
2⤵
PID:1561

/usr/bin/rm
rm -rf /usr/sbin/windump
2⤵
PID:1561

/sbin/rm
rm -rf /usr/sbin/windump
2⤵
PID:1561

/bin/rm
rm -rf /usr/sbin/windump
2⤵
PID:1561

/usr/local/sbin/rm
rm -rf /usr/sbin/netsniff-ng
2⤵
PID:1562

/usr/local/bin/rm
rm -rf /usr/sbin/netsniff-ng
2⤵
PID:1562

/usr/sbin/rm
rm -rf /usr/sbin/netsniff-ng
2⤵
PID:1562

/usr/bin/rm
rm -rf /usr/sbin/netsniff-ng
2⤵
PID:1562

/sbin/rm
rm -rf /usr/sbin/netsniff-ng
2⤵
PID:1562

/bin/rm
rm -rf /usr/sbin/netsniff-ng
2⤵
PID:1562

/usr/local/sbin/rm
rm -rf /usr/bin/tcpdump
2⤵
PID:1563

/usr/local/sbin/rm
rm -rf /usr/bin/tshark
2⤵
PID:1564

/usr/local/sbin/rm
rm -rf /usr/bin/wireshark
2⤵
PID:1565

/usr/local/sbin/rm
rm -rf /usr/bin/dumpcap
2⤵
PID:1566

/usr/local/sbin/rm
rm -rf /usr/bin/windump
2⤵
PID:1571

/usr/local/bin/rm
rm -rf /usr/bin/dumpcap
2⤵
PID:1566

/usr/local/bin/rm
rm -rf /usr/bin/windump
2⤵
PID:1571

/usr/local/bin/rm
rm -rf /usr/bin/tcpdump
2⤵
PID:1563

/usr/local/bin/rm
rm -rf /usr/bin/wireshark
2⤵
PID:1565

/usr/local/bin/rm
rm -rf /usr/bin/tshark
2⤵
PID:1564

/usr/sbin/rm
rm -rf /usr/bin/dumpcap
2⤵
PID:1566

/usr/sbin/rm
rm -rf /usr/bin/windump
2⤵
PID:1571

/usr/sbin/rm
rm -rf /usr/bin/tcpdump
2⤵
PID:1563

/usr/sbin/rm
rm -rf /usr/bin/wireshark
2⤵
PID:1565

/usr/sbin/rm
rm -rf /usr/bin/tshark
2⤵
PID:1564

/usr/local/sbin/rm
rm -rf /usr/sbin/dsniff
2⤵
PID:1558

/usr/bin/rm
rm -rf /usr/bin/windump
2⤵
PID:1571

/usr/bin/rm
rm -rf /usr/bin/dumpcap
2⤵
PID:1566

/usr/bin/rm
rm -rf /usr/bin/tcpdump
2⤵
PID:1563

/usr/bin/rm
rm -rf /usr/bin/wireshark
2⤵
PID:1565

/usr/bin/rm
rm -rf /usr/bin/tshark
2⤵
PID:1564

/sbin/rm
rm -rf /usr/bin/windump
2⤵
PID:1571

/sbin/rm
rm -rf /usr/bin/dumpcap
2⤵
PID:1566

/sbin/rm
rm -rf /usr/bin/tcpdump
2⤵
PID:1563

/sbin/rm
rm -rf /usr/bin/wireshark
2⤵
PID:1565

/sbin/rm
rm -rf /usr/bin/tshark
2⤵
PID:1564

/usr/local/bin/rm
rm -rf /usr/sbin/dsniff
2⤵
PID:1558

/bin/rm
rm -rf /usr/bin/windump
2⤵
PID:1571

/bin/rm
rm -rf /usr/bin/dumpcap
2⤵
PID:1566

/bin/rm
rm -rf /usr/bin/tcpdump
2⤵
PID:1563

/bin/rm
rm -rf /usr/bin/wireshark
2⤵
PID:1565

/bin/rm
rm -rf /usr/bin/tshark
2⤵
PID:1564

/usr/sbin/rm
rm -rf /usr/sbin/dsniff
2⤵
PID:1558

/usr/bin/rm
rm -rf /usr/sbin/dsniff
2⤵
PID:1558

/usr/local/sbin/rm
rm -rf /usr/sbin/ettercap
2⤵
PID:1557

/sbin/rm
rm -rf /usr/sbin/dsniff
2⤵
PID:1558

/bin/rm
rm -rf /usr/sbin/dsniff
2⤵
PID:1558

/usr/local/bin/rm
rm -rf /usr/sbin/ettercap
2⤵
PID:1557

/usr/sbin/rm
rm -rf /usr/sbin/ettercap
2⤵
PID:1557

/usr/bin/rm
rm -rf /usr/sbin/ettercap
2⤵
PID:1557

/sbin/rm
rm -rf /usr/sbin/ettercap
2⤵
PID:1557

/bin/rm
rm -rf /usr/sbin/ettercap
2⤵
PID:1557

/usr/local/sbin/rm
rm -rf /usr/sbin/dumpcap
2⤵
PID:1556

/usr/local/bin/rm
rm -rf /usr/sbin/dumpcap
2⤵
PID:1556

/usr/sbin/rm
rm -rf /usr/sbin/dumpcap
2⤵
PID:1556

/usr/bin/rm
rm -rf /usr/sbin/dumpcap
2⤵
PID:1556

/sbin/rm
rm -rf /usr/sbin/dumpcap
2⤵
PID:1556

/bin/rm
rm -rf /usr/sbin/dumpcap
2⤵
PID:1556

/usr/local/sbin/rm
rm -rf /usr/sbin/wireshark
2⤵
PID:1555

/usr/local/bin/rm
rm -rf /usr/sbin/wireshark
2⤵
PID:1555

/usr/sbin/rm
rm -rf /usr/sbin/wireshark
2⤵
PID:1555

/usr/bin/rm
rm -rf /usr/sbin/wireshark
2⤵
PID:1555

/sbin/rm
rm -rf /usr/sbin/wireshark
2⤵
PID:1555

/bin/rm
rm -rf /usr/sbin/wireshark
2⤵
PID:1555

/usr/local/sbin/rm
rm -rf /usr/sbin/tshark
2⤵
PID:1554

/usr/local/bin/rm
rm -rf /usr/sbin/tshark
2⤵
PID:1554

/usr/sbin/rm
rm -rf /usr/sbin/tshark
2⤵
PID:1554

/usr/bin/rm
rm -rf /usr/sbin/tshark
2⤵
PID:1554

/sbin/rm
rm -rf /usr/sbin/tshark
2⤵
PID:1554

/bin/rm
rm -rf /usr/sbin/tshark
2⤵
PID:1554

/usr/local/sbin/rm
rm -rf /usr/sbin/tcpdump
2⤵
PID:1553

/usr/local/bin/rm
rm -rf /usr/sbin/tcpdump
2⤵
PID:1553

/usr/sbin/rm
rm -rf /usr/sbin/tcpdump
2⤵
PID:1553

/usr/bin/rm
rm -rf /usr/sbin/tcpdump
2⤵
PID:1553

/sbin/rm
rm -rf /usr/sbin/tcpdump
2⤵
PID:1553

/bin/rm
rm -rf /usr/sbin/tcpdump
2⤵
PID:1553

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

4

T1070

Impair Defenses

1

T1562

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads