Overview

overview

7

Static

static

7

pty3

windows10-1703-x64

1

pty3

debian-12-armhf

pty3

debian-9-mips

pty3

debian-9-mipsel

pty3

ubuntu-20.04-amd64

7

pty3

ubuntu-22.04-amd64

1

Resubmissions

17/06/2024, 14:04

240617-rdmhfstflg7

17/06/2024, 14:01

240617-rbvq2sxhjm7

Analysis

  • max time kernel
    62s
  • max time network
    64s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    17/06/2024, 14:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    pty3
  • Size 47KB
  • Sample240617-rdmhfstflg
  • SHA256 9e28f942262805b5fb59f46568fed53fd4b7dbf6faf666bedaf6ff22dd416572
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
persistenceupx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Creates/modifies Cron job 1 TTPs 5 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/pty3
    /tmp/pty3
    1⤵
    • Changes its process name
    • Writes file to tmp directory
    PID:1433
    • /bin/sh
      sh -c "pidof -x strace > /dev/null"
      2⤵
        PID:1434
        • /usr/bin/pidof
          pidof -x strace
          3⤵
          • Reads runtime system information
          PID:1435
      • /bin/sh
        sh -c "pidof -x tcpdump > /dev/null"
        2⤵
          PID:1436
          • /usr/bin/pidof
            pidof -x tcpdump
            3⤵
            • Reads runtime system information
            PID:1437
        • /bin/sh
          sh -c "cat /etc/inittab | grep -v \"/tmp/pty3\" > /etc/inittab2"
          2⤵
            PID:1440
            • /usr/bin/cat
              cat /etc/inittab
              3⤵
                PID:1441
              • /usr/bin/grep
                grep -v /tmp/pty3
                3⤵
                  PID:1442
              • /bin/sh
                sh -c "crontab -l | grep /tmp/pty3 | grep -v \"no cron\" || (crontab -l ; echo \"* * * * * /tmp/pty3 > /dev/null 2>&1 &\") | crontab -"
                2⤵
                  PID:1443
                  • /usr/bin/grep
                    grep /tmp/pty3
                    3⤵
                      PID:1446
                    • /usr/bin/grep
                      grep -v "no cron"
                      3⤵
                        PID:1447
                      • /usr/bin/crontab
                        crontab -l
                        3⤵
                          PID:1445
                        • /usr/bin/crontab
                          crontab -
                          3⤵
                          • Creates/modifies Cron job
                          PID:1451
                        • /usr/bin/crontab
                          crontab -l
                          3⤵
                            PID:1452
                        • /bin/sh
                          sh -c "crontab -r"
                          2⤵
                            PID:1444
                            • /usr/bin/crontab
                              crontab -r
                              3⤵
                                PID:1448
                            • /bin/sh
                              sh -c "echo \"0:2345:respawn:/tmp/pty3\" >> /etc/inittab2"
                              2⤵
                                PID:1449
                              • /bin/sh
                                sh -c "cat /etc/inittab2 > /etc/inittab"
                                2⤵
                                  PID:1453
                                  • /usr/bin/cat
                                    cat /etc/inittab2
                                    3⤵
                                      PID:1454
                                  • /bin/sh
                                    sh -c "rm -rf /etc/inittab2"
                                    2⤵
                                      PID:1455
                                      • /usr/bin/rm
                                        rm -rf /etc/inittab2
                                        3⤵
                                          PID:1456
                                      • /bin/sh
                                        sh -c "touch -acmr /bin/ls /etc/inittab"
                                        2⤵
                                          PID:1457
                                          • /usr/bin/touch
                                            touch -acmr /bin/ls /etc/inittab
                                            3⤵
                                              PID:1458
                                          • /bin/sh
                                            sh -c "/bin/uname -n"
                                            2⤵
                                              PID:1461
                                              • /bin/uname
                                                /bin/uname -n
                                                3⤵
                                                  PID:1463
                                              • /bin/sh
                                                sh -c "cp -f /tmp/pty3 /dev/shm/pty3"
                                                2⤵
                                                  PID:1462
                                                  • /usr/bin/cp
                                                    cp -f /tmp/pty3 /dev/shm/pty3
                                                    3⤵
                                                    • Writes file to shm directory
                                                    PID:1464
                                                • /bin/sh
                                                  sh -c "cat /etc/inittab | grep -v \"/dev/shm/pty3\" > /etc/inittab2"
                                                  2⤵
                                                    PID:1466
                                                    • /usr/bin/grep
                                                      grep -v /dev/shm/pty3
                                                      3⤵
                                                        PID:1468
                                                      • /usr/bin/cat
                                                        cat /etc/inittab
                                                        3⤵
                                                          PID:1467
                                                      • /bin/sh
                                                        sh -c "crontab -l | grep /dev/shm/pty3 | grep -v \"no cron\" || (crontab -l ; echo \"* * * * * /dev/shm/pty3 > /dev/null 2>&1 &\") | crontab -"
                                                        2⤵
                                                          PID:1469
                                                          • /usr/bin/grep
                                                            grep -v "no cron"
                                                            3⤵
                                                              PID:1473
                                                            • /usr/bin/grep
                                                              grep /dev/shm/pty3
                                                              3⤵
                                                                PID:1472
                                                              • /usr/bin/crontab
                                                                crontab -l
                                                                3⤵
                                                                  PID:1471
                                                                • /usr/bin/crontab
                                                                  crontab -
                                                                  3⤵
                                                                  • Creates/modifies Cron job
                                                                  PID:1476
                                                                • /usr/bin/crontab
                                                                  crontab -l
                                                                  3⤵
                                                                    PID:1478
                                                                • /bin/sh
                                                                  sh -c "echo \"0:2345:respawn:/dev/shm/pty3\" >> /etc/inittab2"
                                                                  2⤵
                                                                    PID:1470
                                                                  • /bin/sh
                                                                    sh -c "cat /etc/inittab2 > /etc/inittab"
                                                                    2⤵
                                                                      PID:1474
                                                                      • /usr/bin/cat
                                                                        cat /etc/inittab2
                                                                        3⤵
                                                                          PID:1477
                                                                      • /bin/sh
                                                                        sh -c "rm -rf /etc/inittab2"
                                                                        2⤵
                                                                          PID:1479
                                                                          • /usr/bin/rm
                                                                            rm -rf /etc/inittab2
                                                                            3⤵
                                                                              PID:1480
                                                                          • /bin/sh
                                                                            sh -c "touch -acmr /bin/ls /etc/inittab"
                                                                            2⤵
                                                                              PID:1481
                                                                              • /usr/bin/touch
                                                                                touch -acmr /bin/ls /etc/inittab
                                                                                3⤵
                                                                                  PID:1482
                                                                              • /bin/sh
                                                                                sh -c "cp -f /tmp/pty3 /var/tmp/pty3"
                                                                                2⤵
                                                                                  PID:1483
                                                                                  • /usr/bin/cp
                                                                                    cp -f /tmp/pty3 /var/tmp/pty3
                                                                                    3⤵
                                                                                      PID:1484
                                                                                  • /bin/sh
                                                                                    sh -c "cat /etc/inittab | grep -v \"/var/tmp/pty3\" > /etc/inittab2"
                                                                                    2⤵
                                                                                      PID:1486
                                                                                      • /usr/bin/grep
                                                                                        grep -v /var/tmp/pty3
                                                                                        3⤵
                                                                                          PID:1488
                                                                                        • /usr/bin/cat
                                                                                          cat /etc/inittab
                                                                                          3⤵
                                                                                            PID:1487
                                                                                        • /bin/sh
                                                                                          sh -c "crontab -l | grep /var/tmp/pty3 | grep -v \"no cron\" || (crontab -l ; echo \"* * * * * /var/tmp/pty3 > /dev/null 2>&1 &\") | crontab -"
                                                                                          2⤵
                                                                                            PID:1489
                                                                                            • /usr/bin/grep
                                                                                              grep -v "no cron"
                                                                                              3⤵
                                                                                                PID:1493
                                                                                              • /usr/bin/crontab
                                                                                                crontab -l
                                                                                                3⤵
                                                                                                  PID:1490
                                                                                                • /usr/bin/grep
                                                                                                  grep /var/tmp/pty3
                                                                                                  3⤵
                                                                                                    PID:1492
                                                                                                  • /usr/bin/crontab
                                                                                                    crontab -
                                                                                                    3⤵
                                                                                                    • Creates/modifies Cron job
                                                                                                    PID:1496
                                                                                                  • /usr/bin/crontab
                                                                                                    crontab -l
                                                                                                    3⤵
                                                                                                      PID:1498
                                                                                                  • /bin/sh
                                                                                                    sh -c "echo \"0:2345:respawn:/var/tmp/pty3\" >> /etc/inittab2"
                                                                                                    2⤵
                                                                                                      PID:1491
                                                                                                    • /bin/sh
                                                                                                      sh -c "cat /etc/inittab2 > /etc/inittab"
                                                                                                      2⤵
                                                                                                        PID:1494
                                                                                                        • /usr/bin/cat
                                                                                                          cat /etc/inittab2
                                                                                                          3⤵
                                                                                                            PID:1497
                                                                                                        • /bin/sh
                                                                                                          sh -c "rm -rf /etc/inittab2"
                                                                                                          2⤵
                                                                                                            PID:1499
                                                                                                            • /usr/bin/rm
                                                                                                              rm -rf /etc/inittab2
                                                                                                              3⤵
                                                                                                                PID:1500
                                                                                                            • /bin/sh
                                                                                                              sh -c "touch -acmr /bin/ls /etc/inittab"
                                                                                                              2⤵
                                                                                                                PID:1501
                                                                                                                • /usr/bin/touch
                                                                                                                  touch -acmr /bin/ls /etc/inittab
                                                                                                                  3⤵
                                                                                                                    PID:1502
                                                                                                                • /bin/sh
                                                                                                                  sh -c "cp -f /tmp/pty3 /var/lock/pty3"
                                                                                                                  2⤵
                                                                                                                    PID:1503
                                                                                                                    • /usr/bin/cp
                                                                                                                      cp -f /tmp/pty3 /var/lock/pty3
                                                                                                                      3⤵
                                                                                                                        PID:1504
                                                                                                                    • /bin/sh
                                                                                                                      sh -c "cat /etc/inittab | grep -v \"/var/lock/pty3\" > /etc/inittab2"
                                                                                                                      2⤵
                                                                                                                        PID:1506
                                                                                                                        • /usr/bin/grep
                                                                                                                          grep -v /var/lock/pty3
                                                                                                                          3⤵
                                                                                                                            PID:1508
                                                                                                                          • /usr/bin/cat
                                                                                                                            cat /etc/inittab
                                                                                                                            3⤵
                                                                                                                              PID:1507
                                                                                                                          • /bin/sh
                                                                                                                            sh -c "crontab -l | grep /var/lock/pty3 | grep -v \"no cron\" || (crontab -l ; echo \"* * * * * /var/lock/pty3 > /dev/null 2>&1 &\") | crontab -"
                                                                                                                            2⤵
                                                                                                                              PID:1509
                                                                                                                              • /usr/bin/grep
                                                                                                                                grep -v "no cron"
                                                                                                                                3⤵
                                                                                                                                  PID:1513
                                                                                                                                • /usr/bin/grep
                                                                                                                                  grep /var/lock/pty3
                                                                                                                                  3⤵
                                                                                                                                    PID:1511
                                                                                                                                  • /usr/bin/crontab
                                                                                                                                    crontab -l
                                                                                                                                    3⤵
                                                                                                                                      PID:1510
                                                                                                                                    • /usr/bin/crontab
                                                                                                                                      crontab -
                                                                                                                                      3⤵
                                                                                                                                      • Creates/modifies Cron job
                                                                                                                                      PID:1516
                                                                                                                                    • /usr/bin/crontab
                                                                                                                                      crontab -l
                                                                                                                                      3⤵
                                                                                                                                        PID:1518
                                                                                                                                    • /bin/sh
                                                                                                                                      sh -c "echo \"0:2345:respawn:/var/lock/pty3\" >> /etc/inittab2"
                                                                                                                                      2⤵
                                                                                                                                        PID:1512
                                                                                                                                      • /bin/sh
                                                                                                                                        sh -c "cat /etc/inittab2 > /etc/inittab"
                                                                                                                                        2⤵
                                                                                                                                          PID:1514
                                                                                                                                          • /usr/bin/cat
                                                                                                                                            cat /etc/inittab2
                                                                                                                                            3⤵
                                                                                                                                              PID:1517
                                                                                                                                          • /bin/sh
                                                                                                                                            sh -c "rm -rf /etc/inittab2"
                                                                                                                                            2⤵
                                                                                                                                              PID:1519
                                                                                                                                              • /usr/bin/rm
                                                                                                                                                rm -rf /etc/inittab2
                                                                                                                                                3⤵
                                                                                                                                                  PID:1520
                                                                                                                                              • /bin/sh
                                                                                                                                                sh -c "touch -acmr /bin/ls /etc/inittab"
                                                                                                                                                2⤵
                                                                                                                                                  PID:1521
                                                                                                                                                  • /usr/bin/touch
                                                                                                                                                    touch -acmr /bin/ls /etc/inittab
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1522
                                                                                                                                                  • /bin/sh
                                                                                                                                                    sh -c "cp -f /tmp/pty3 /var/run/pty3"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1523
                                                                                                                                                      • /usr/bin/cp
                                                                                                                                                        cp -f /tmp/pty3 /var/run/pty3
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1524
                                                                                                                                                      • /bin/sh
                                                                                                                                                        sh -c "cat /etc/inittab | grep -v \"/var/run/pty3\" > /etc/inittab2"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1526
                                                                                                                                                          • /usr/bin/grep
                                                                                                                                                            grep -v /var/run/pty3
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1528
                                                                                                                                                            • /usr/bin/cat
                                                                                                                                                              cat /etc/inittab
                                                                                                                                                              3⤵
                                                                                                                                                                PID:1527
                                                                                                                                                            • /bin/sh
                                                                                                                                                              sh -c "crontab -l | grep /var/run/pty3 | grep -v \"no cron\" || (crontab -l ; echo \"* * * * * /var/run/pty3 > /dev/null 2>&1 &\") | crontab -"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1529
                                                                                                                                                                • /usr/bin/grep
                                                                                                                                                                  grep -v "no cron"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1533
                                                                                                                                                                  • /usr/bin/grep
                                                                                                                                                                    grep /var/run/pty3
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1532
                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                      crontab -l
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:1530
                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                        crontab -
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Creates/modifies Cron job
                                                                                                                                                                        PID:1536
                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                        crontab -l
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:1538
                                                                                                                                                                      • /bin/sh
                                                                                                                                                                        sh -c "echo \"0:2345:respawn:/var/run/pty3\" >> /etc/inittab2"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1531
                                                                                                                                                                        • /bin/sh
                                                                                                                                                                          sh -c "cat /etc/inittab2 > /etc/inittab"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1534
                                                                                                                                                                            • /usr/bin/cat
                                                                                                                                                                              cat /etc/inittab2
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1537
                                                                                                                                                                            • /bin/sh
                                                                                                                                                                              sh -c "rm -rf /etc/inittab2"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:1539
                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                  rm -rf /etc/inittab2
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1540
                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                  sh -c "touch -acmr /bin/ls /etc/inittab"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1541
                                                                                                                                                                                    • /usr/bin/touch
                                                                                                                                                                                      touch -acmr /bin/ls /etc/inittab
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:1542

                                                                                                                                                                                  Network

                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                        Downloads

                                                                                                                                                                                        pty3
                                                                                                                                                                                        • Path /dev/shm/pty3
                                                                                                                                                                                        • Size 47KB
                                                                                                                                                                                        • SHA256 9e28f942262805b5fb59f46568fed53fd4b7dbf6faf666bedaf6ff22dd416572
                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        inittab
                                                                                                                                                                                        • Path /etc/inittab
                                                                                                                                                                                        • Size 83B
                                                                                                                                                                                        • SHA256 0a4eb5870807ef4406d093845baf96e7f8cc59effda08f32a4d73d489264d11a
                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        inittab
                                                                                                                                                                                        • Path /etc/inittab
                                                                                                                                                                                        • Size 113B
                                                                                                                                                                                        • SHA256 247ae0a8c28f9e39397c45a9e586b8b2c371878cf8814f9cf41c76aa05939552
                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        inittab2
                                                                                                                                                                                        • Path /etc/inittab2
                                                                                                                                                                                        • Size 142B
                                                                                                                                                                                        • SHA256 bf7a744dcb866fe6c59f07c77d2b579c84b057f79321028b6b45320e4f6a2eed
                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        inittab2
                                                                                                                                                                                        • Path /etc/inittab2
                                                                                                                                                                                        • Size 25B
                                                                                                                                                                                        • SHA256 bf305607b10a91ee18ceef3ca7843f016eba8e25cfaa8c4bb88ae79c2c06f561
                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        inittab2
                                                                                                                                                                                        • Path /etc/inittab2
                                                                                                                                                                                        • Size 54B
                                                                                                                                                                                        • SHA256 e5018fad1758921486984b6c0d39050ec65f06908d99387dc15363ca5557c581
                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        tmp.5pb0aO
                                                                                                                                                                                        • Path /var/spool/cron/crontabs/tmp.5pb0aO
                                                                                                                                                                                        • Size 344B
                                                                                                                                                                                        • SHA256 c88aa1b503c9409b0912d3ef0fc39517f79911f47591a638b2f28219f9d4a642
                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        tmp.CdHZvk
                                                                                                                                                                                        • Path /var/spool/cron/crontabs/tmp.CdHZvk
                                                                                                                                                                                        • Size 387B
                                                                                                                                                                                        • SHA256 297cc7a4fdd42e134cf63e5ebddb13679f3c6dc6de11d7a8000c8cc7a659e8b0
                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        tmp.GoENqi
                                                                                                                                                                                        • Path /var/spool/cron/crontabs/tmp.GoENqi
                                                                                                                                                                                        • Size 300B
                                                                                                                                                                                        • SHA256 00e39e075872a92396d2526f39f40af4ab57bd62556dc7ac4d0a7d7606c0bd4f
                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        tmp.S68SIP
                                                                                                                                                                                        • Path /var/spool/cron/crontabs/tmp.S68SIP
                                                                                                                                                                                        • Size 257B
                                                                                                                                                                                        • SHA256 32979b137623f1949c506210fdc5c8e48fc0bdb0a44c06558491f866ee708b09
                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                        Submit Download

                                                                                                                                                                                        tmp.tP1GfV
                                                                                                                                                                                        • Path /var/spool/cron/crontabs/tmp.tP1GfV
                                                                                                                                                                                        • Size 214B
                                                                                                                                                                                        • SHA256 7f211a15a7b55eccc040a78bb51b04b909c0052539ba457bcecbd3b879fd9e7e
                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                        Submit Download