492183967bfb7525e875333217e13095c369984892743a1ed47379a93e29a5d6

General

Target
Bussin GriddyCode.x86_64asdasd
Size 94.0MB
Sample240504-tg1wcsde65
SHA256 492183967bfb7525e875333217e13095c369984892743a1ed47379a93e29a5d6
MD5 bcde2680067c7a53b4bfda56f997817d
SHA1 a9e5410b894938f3b72d3b7d6d2707ca9ac5df88
SHA512 9dd3ed11f2717998a687956dcf2e533b828de8ab3b25b3f4cbdf3ec221806604a980fdb0aedb6d5f0484869d124f5fb25e503834011f9086bc808c61fff21bb0
SSDEEP 1572864:OTsfdxMUIv9lqP1Q6SNlc8yvUFLicloBBKO+4vgn9zg:E4d2hK+HN+82UFLoBBS4X
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

keylogger

Malware Config

Signatures

Reads hardware input events 4 IoCs

Reads raw input events from the evdev driver, possibly to record keystrokes.

keylogger

description	ioc	Process
File opened for reading	/dev/input/event2	Bussin GriddyCode.x86_64asdasd
File opened for reading	/dev/input/event1	Bussin GriddyCode.x86_64asdasd
File opened for reading	/dev/input/event3	Bussin GriddyCode.x86_64asdasd
File opened for reading	/dev/input/event0	Bussin GriddyCode.x86_64asdasd

Changes its process name 1 IoCs

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	Bussin :disk$0	1545

Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	Bussin GriddyCode.x86_64asdasd

Enumerates kernel/hardware configuration 1 TTPs 21 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/class	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/0003:0627:0001.0001/input/input4/mouse0/uevent	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/0003:0627:0001.0001/input/input4/event2/uevent	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/devices/system/cpu	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/devices/virtual/input/mice/uevent	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/devices/platform/i8042/serio1/input/input3/event3/uevent	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/0003:0627:0001.0001/input/input4/uevent	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/class/input	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/devices/LNXSYSTM:00/LNXPWRBN:00/input/input0/uevent	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/devices/LNXSYSTM:00/LNXPWRBN:00/input/input0/event0/uevent	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/devices/platform/i8042/serio1/input/input3/mouse1/uevent	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/bus	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/devices/platform/i8042/serio1/input/input3/uevent	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/devices/platform/i8042/serio0/input/input1/uevent	Bussin GriddyCode.x86_64asdasd
File opened for reading	/sys/devices/platform/i8042/serio0/input/input1/event1/uevent	Bussin GriddyCode.x86_64asdasd

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/fd	Bussin GriddyCode.x86_64asdasd
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/1608/status	dbus-daemon
File opened for reading	/proc/1608/attr/current	dbus-daemon
File opened for reading	/proc/1483/cmdline	dbus-daemon

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/godot/app_userdata/Bussin GriddyCode/logs/godot.log	Bussin GriddyCode.x86_64asdasd

/tmp/Bussin GriddyCode.x86_64asdasd
"/tmp/Bussin GriddyCode.x86_64asdasd"
1⤵
- Reads hardware input events
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1483
- /bin/sh
  sh -c "\"xdg-user-dir\" \"DESKTOP\" 2>/dev/null"
  2⤵
  PID:1484
- - /usr/bin/xdg-user-dir
    xdg-user-dir DESKTOP
    3⤵
    PID:1485
- /usr/bin/dbus-launch
  dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
  2⤵
  PID:1597
- - /usr/bin/dbus-daemon
    /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1602

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f9a883b5ee30648c1fe9fedc3ed4b82b18915c.tmp

Path /root/.cache/mesa_shader_cache/3f/f9a883b5ee30648c1fe9fedc3ed4b82b18915c.tmp
Size 3KB
SHA256 b22a2ef61de99349714c566605fc96a63f1305474062770f1528a33f14c1c89a
MD5 107dd6c4b7430998e1f03f97de167e73
SHA1 09c7792ce1e87788904066a6adad1790a18aaa4c
SHA512 1f9f1034c92a1e4855fe419634b8ec22b0b19509cf9b2b21292bcb9d83045859aec6b2f2579317b1098e12e31f680f25fcb7596f89ee1d560f04d878f2e97ac0
MD5 SHA1 SHA512

Submit Download

4816dd152e8c48ff97e9117d197c13d8-0

Path /root/.dbus/session-bus/4816dd152e8c48ff97e9117d197c13d8-0
Size 466B
SHA256 926f41cae7f1690e4c18f5b32c8ec4d30425b5498c1a5041d036c69e7bf5d03c
MD5 5365291e2a967b3bb3192ed8e37cb186
SHA1 b792066540fe64aeb9823959e8656f21bc285203
SHA512 136e410f407768443c0f4230a61b39c9ef8bdf3ca0e02d1bb0f69bb79b2314b1b0afe0eec263af1536d382467151b57a32530d1d4734cfe334fca84899539c4c
MD5 SHA1 SHA512

Submit Download

godot.log

Path /tmp/godot/app_userdata/Bussin GriddyCode/logs/godot.log
Size 17KB
SHA256 0e09e2822fe0339fa4c51e70193b4e3859a6022469e128cfd2c2d8b7143d6e8a
MD5 ca2a8cb24a42a3d6f0a9928dfaf82865
SHA1 b58b80cb35f31e5aede7a9d9d0df90cb5dbaebb2
SHA512 fdd06ca136de1bc293a7d23341066d24703d4c337549d612746b8101ed1ae6ca74b5942ffa3b8596c5b2d815deddcd8342c6b1b3f945d26231803894f871c7c6
SSDEEP 96:uyXVJzCROIGfOIROZGfOZGROnGROCGRO8/Om/Ol/OQ/OksHXGRBLcL9LBXGRWGRV:uylJzSK6xB2Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads