7a7bfa4f84e073d45b33ca6d4e5f263d31aa512d124bc6c682029f2b831c7c08

Analysis

max time kernel
10s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28-06-2024 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.rsync/a/a
Size

876B
MD5

de5869436d84eee7b336fb5c51675290
SHA1

4427d10cc48b92208b9d61b45f45b3156e884813
SHA256

9d4fef06b12d18385f1c45dd4e37f031c6590b080ea5446ff7a5bac491daea50
SHA512

f26bcbdcf7417308bdec3f3f8b6ef453d2b7417b16d015eeddfc447955068b48667554fd9a1b896ee9d44ac3c2cac54137fc455c45f94251f42e5e3a1e7b6230

Score

7^/10

antivm rootkit

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

upd

ioc pid process

/tmp/.rsync/a/upd 1523 upd
Loads a kernel module 1 IoCs
Loads a Linux kernel module, potentially to achieve persistence
rootkit

Processes:

modprobe

ioc pid process

/lib/modules/4.15.0-213-generic/kernel/arch/x86/kernel/msr.ko 1513 modprobe
Enumerates running processes
Discovers information about currently running processes on the system
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

catcat

description ioc process

File opened for reading /proc/cpuinfo cat
File opened for reading /proc/cpuinfo cat
Reads CPU attributes 1 TTPs 2 IoCs

System Information Discovery
T1082

Processes:

pspkill

description ioc process

File opened for reading /sys/devices/system/cpu/online ps
File opened for reading /sys/devices/system/cpu/online pkill
Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery
T1082

Processes:

amodprobe

description ioc process

File opened for reading /sys/devices/system/node a
File opened for reading /sys/module/msr/initstate modprobe

ioc	pid	process
/tmp/.rsync/a/upd	1523	upd

ioc	pid	process
/lib/modules/4.15.0-213-generic/kernel/arch/x86/kernel/msr.ko	1513	modprobe

description	ioc	process
File opened for reading	/proc/cpuinfo	cat
File opened for reading	/proc/cpuinfo	cat

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill

description	ioc	process
File opened for reading	/sys/devices/system/node	a
File opened for reading	/sys/module/msr/initstate	modprobe

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

killallpspkill

description	ioc	process
File opened for reading	/proc/1504/stat	killall
File opened for reading	/proc/34/status	ps
File opened for reading	/proc/581/cmdline	pkill
File opened for reading	/proc/1169/cmdline	pkill
File opened for reading	/proc/460/status	ps
File opened for reading	/proc/547/cmdline	ps
File opened for reading	/proc/581/status	pkill
File opened for reading	/proc/84/stat	killall
File opened for reading	/proc/972/stat	killall
File opened for reading	/proc/581/cmdline	ps
File opened for reading	/proc/962/status	ps
File opened for reading	/proc/962/cmdline	ps
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/972/cmdline	pkill
File opened for reading	/proc/177/cmdline	ps
File opened for reading	/proc/517/stat	ps
File opened for reading	/proc/1142/stat	ps
File opened for reading	/proc/1502/stat	ps
File opened for reading	/proc/1073/status	pkill
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/1301/cmdline	killall
File opened for reading	/proc/170/cmdline	ps
File opened for reading	/proc/1084/stat	ps
File opened for reading	/proc/250/cmdline	killall
File opened for reading	/proc/280/stat	killall
File opened for reading	/proc/1291/status	pkill
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/1318/stat	ps
File opened for reading	/proc/446/status	pkill
File opened for reading	/proc/1197/cmdline	pkill
File opened for reading	/proc/172/stat	ps
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/475/stat	killall
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/1197/cmdline	ps
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/1060/cmdline	pkill
File opened for reading	/proc/1343/stat	ps
File opened for reading	/proc/1379/status	ps
File opened for reading	/proc/323/stat	killall
File opened for reading	/proc/1192/status	ps
File opened for reading	/proc/215/cmdline	killall
File opened for reading	/proc/1/cmdline	ps
File opened for reading	/proc/26/cmdline	ps
File opened for reading	/proc/1169/status	ps
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/185/status	pkill
File opened for reading	/proc/85/stat	killall
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/1146/stat	ps
File opened for reading	/proc/1188/cmdline	ps
File opened for reading	/proc/1197/stat	ps
File opened for reading	/proc/1189/cmdline	pkill
File opened for reading	/proc/25/stat	killall
File opened for reading	/proc/683/stat	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/82/stat	killall
File opened for reading	/proc/467/stat	killall
File opened for reading	/proc/1273/stat	killall
File opened for reading	/proc/184/cmdline	ps
File opened for reading	/proc/1531/stat	ps
File opened for reading	/proc/1288/cmdline	pkill
File opened for reading	/proc/1503/status	pkill

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

Processes:

astoprun

description	ioc	process
File opened for modification	/tmp/.rsync/a/upd	a
File opened for modification	/tmp/.rsync/a/.proc	stop
File opened for modification	/tmp/.rsync/a/dir.dir	run
File opened for modification	/tmp/.rsync/a/bash.pid	run
File opened for modification	/tmp/.rsync/a/dir.dir	a

/tmp/.rsync/a/a
/tmp/.rsync/a/a
1⤵
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:1507
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:1508
- /bin/cat
  cat dir.dir
  2⤵
  PID:1509
- /usr/bin/nproc
  nproc
  2⤵
  PID:1510
- /sbin/sysctl
  sysctl -w "vm.nr_hugepages=1"
  2⤵
  PID:1511
- /usr/bin/find
  find /sys/devices/system/node/node0 -maxdepth 0 -type d
  2⤵
  PID:1512
- /sbin/modprobe
  modprobe msr
  2⤵
  - Loads a kernel module
  - Enumerates kernel/hardware configuration
  PID:1513
- /bin/grep
  grep "AMD Ryzen"
  2⤵
  PID:1518
- /bin/cat
  cat /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  PID:1517
- /bin/grep
  grep Intel
  2⤵
  PID:1520
- /bin/cat
  cat /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  PID:1519
- /bin/chmod
  chmod u+x upd
  2⤵
  PID:1521
- /bin/chmod
  chmod 777 a anacron cron dir.dir run stop upd
  2⤵
  PID:1522
- /tmp/.rsync/a/upd
  ./upd
  2⤵
  - Executes dropped EXE
  PID:1523

/tmp/.rsync/a/run
./run
1⤵
- Writes file to tmp directory
PID:1524
- /tmp/.rsync/a/stop
  ./stop
  2⤵
  - Writes file to tmp directory
  PID:1525
- - /usr/bin/pkill
    pkill -9 cron
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1526
- - /usr/bin/killall
    killall -9 cron
    3⤵
    - Reads runtime system information
    PID:1527
- - /usr/bin/awk
    awk "{print \$1}"
    3⤵
    PID:1532
- - /bin/grep
    grep -v grep
    3⤵
    PID:1531
- - /bin/grep
    grep cron
    3⤵
    PID:1530
- - /bin/ps
    ps x
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1529
- - /bin/rm
    rm -rf .proc
    3⤵
    PID:1533
- /bin/sleep
  sleep 10
  2⤵
  PID:1534
- /bin/cat
  cat dir.dir
  2⤵
  PID:1538
- /bin/uname
  uname -m
  2⤵
  PID:1539
- /tmp/.rsync/a/cron
  ./cron
  2⤵
  PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/.rsync/a/bash.pid

Filesize
1B

MD5
68b329da9893e34099c7d8ad5cb9c940

SHA1
adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

SHA256
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

SHA512
be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

Download Submit
/tmp/.rsync/a/dir.dir

Filesize
14B

MD5
b3d878adcf4672bbd1f31cffac10c769

SHA1
ce5798837933ece35a7e26a0a3dc06cab19c6275

SHA256
ea5fce19c5fbbbc6c3c36eb9e8e295dfb525e9669aafaf8abe9ddb4e00e345c7

SHA512
019d21a618b3ccc70c0c7ede225cbbb704e2b448048586c44c74c81a747129da9f3f9675f2a29363af320d2684974a1ff00ac608c53de4458aeacd3ed4f9da2c

Download Submit
/tmp/.rsync/a/upd

Filesize
175B

MD5
a136fbe534c2487d3c89bd6a26847bd0

SHA1
11b9362ba79b67dd5d5baf7cf11e0003f049d6e0

SHA256
419a443ff93475ef3abb6e71e5a94e56aea8b7c1f1c4402b3662425815432d46

SHA512
85047cf9d22037d2581ae41275107b243c0bb3259b57fe46bd3fd04a1abe75a7fdeace8a9eae1fae31349a00183206b40259ab3957db8f4f16a79e67133485e9

Download Submit