Overview

overview

10

Static

static

10

fe9f3b7451...ked_49

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    2s
  • max time network
    179s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240418-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240418-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    06-05-2024 09:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fe9f3b7451913f184e1f53b52a03a981dcea5564633cfcb70d01bd0aec8f30a7_unpacked_49

  • Size

    27KB

  • MD5

    75d389d0f987a21bf959ca222844516a

  • SHA1

    ef03b84048193a158ecf1f7033ab0cc8869dd2a5

  • SHA256

    b83127fbde5074247b81012553de69604365f7c4c378d8bcb54552c81ea85414

  • SHA512

    96189c8db80c685b56f41a39ca8c319b6306240f10795e758a9812b2923dcc0d40d01551e7127c1e2c74fc6bfb2a3512ae4856040ff01bedd9fb4f22f5dc50a2

  • SSDEEP

    768:BSD/o+FMXrThYxtXZZTthZbDRSDOfQEd0iFXPRPLd3:O/o+FMXrThYxtjTthZN0iFXPRPh

Score
10/10
bpfdoorbackdoor

Malware Config

Signatures

  • BPFDoor

    BPFDoor is an evasive Linux backdoor attributed to a Chinese threat actor called Red Menshen.

    backdoorbpfdoor
  • BPFDoor payload 1 IoCs
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/fe9f3b7451913f184e1f53b52a03a981dcea5564633cfcb70d01bd0aec8f30a7_unpacked_49
    /tmp/fe9f3b7451913f184e1f53b52a03a981dcea5564633cfcb70d01bd0aec8f30a7_unpacked_49
    1⤵
      PID:1526
      • /bin/sh
        sh -c "/bin/rm -f /var/lock/balance;/bin/cp /tmp/fe9f3b7451913f184e1f53b52a03a981dcea5564633cfcb70d01bd0aec8f30a7_unpacked_49 /var/lock/balance && /bin/chmod 755 /var/lock/balance && /var/lock/balance --init"
        2⤵
          PID:1527
          • /bin/rm
            /bin/rm -f /var/lock/balance
            3⤵
              PID:1528
            • /bin/cp
              /bin/cp /tmp/fe9f3b7451913f184e1f53b52a03a981dcea5564633cfcb70d01bd0aec8f30a7_unpacked_49 /var/lock/balance
              3⤵
              • Reads runtime system information
              PID:1529
            • /bin/chmod
              /bin/chmod 755 /var/lock/balance
              3⤵
                PID:1530
              • /var/lock/balance
                /var/lock/balance --init
                3⤵
                  PID:1531

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • /run/lock/balance
              Filesize

              27KB

              MD5

              75d389d0f987a21bf959ca222844516a

              SHA1

              ef03b84048193a158ecf1f7033ab0cc8869dd2a5

              SHA256

              b83127fbde5074247b81012553de69604365f7c4c378d8bcb54552c81ea85414

              SHA512

              96189c8db80c685b56f41a39ca8c319b6306240f10795e758a9812b2923dcc0d40d01551e7127c1e2c74fc6bfb2a3512ae4856040ff01bedd9fb4f22f5dc50a2

              Download Submit