Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    18-07-2024 21:48

General

  • Target

    The-MALWARE-Repo-master/Botnets/FritzFrog/041bc20ca8ac3161098cbc976e67e3c0f1b672ad36ecbe22fd21cbd53bcaa742

  • Size

    8.7MB

  • MD5

    76fe4fdd628218f630ba50f91ceba852

  • SHA1

    6e90f2fe619597115e5b8dd8b0d1fb0c8ad33fa4

  • SHA256

    041bc20ca8ac3161098cbc976e67e3c0f1b672ad36ecbe22fd21cbd53bcaa742

  • SHA512

    7956505ae0d8479a92ddf97bb09a757566ef526934ee06b4273f0fc450e4da9204808ffa4f4674f4e6e313eb718a7c65f258ef8d23b9769b8aa12d47610d8011

  • SSDEEP

    98304:f27or8Dynb9c4EHv9/fW/NQXPvTCaedHuaJE3fSdCnKg27Xk:f27or8DyO4UnwQfvTCXdHua4No

Score
8/10

Malware Config

Signatures

  • Adds new SSH keys 1 IoCs

    Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

  • Deletes itself 1 IoCs
  • Deletes log files 1 TTPs 1 IoCs

    Deletes log files on the system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 30 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/041bc20ca8ac3161098cbc976e67e3c0f1b672ad36ecbe22fd21cbd53bcaa742
    /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/041bc20ca8ac3161098cbc976e67e3c0f1b672ad36ecbe22fd21cbd53bcaa742
    1⤵
    • Adds new SSH keys
    • Deletes log files
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1570
    • /usr/bin/uname
      uname -a
      2⤵
        PID:1581
      • /usr/bin/cat
        cat /proc/cpuinfo
        2⤵
        • Checks CPU configuration
        PID:1585
      • /usr/bin/cat
        cat /etc/issue
        2⤵
          PID:1586
        • /usr/bin/free
          free -m
          2⤵
          • Reads CPU attributes
          PID:1587
        • /usr/bin/uptime
          uptime
          2⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1588
        • /usr/bin/journalctl
          journalctl -S "@0" -u sshd
          2⤵
          • Reads runtime system information
          PID:1589
        • /usr/bin/cat
          cat "/var/log/auth*"
          2⤵
            PID:1590
          • /usr/bin/zcat
            zcat "/var/log/auth*"
            2⤵
              PID:1591
            • /usr/local/sbin/gzip
              gzip -cd "/var/log/auth*"
              2⤵
                PID:1591
              • /usr/local/bin/gzip
                gzip -cd "/var/log/auth*"
                2⤵
                  PID:1591
                • /usr/sbin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                    PID:1591
                  • /usr/bin/gzip
                    gzip -cd "/var/log/auth*"
                    2⤵
                      PID:1591
                    • /usr/bin/free
                      free -m
                      2⤵
                      • Reads CPU attributes
                      PID:1592
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Reads CPU attributes
                      PID:1593
                    • /usr/bin/free
                      free -m
                      2⤵
                      • Reads CPU attributes
                      PID:1594
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Reads CPU attributes
                      PID:1595
                    • /usr/bin/free
                      free -m
                      2⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:1598
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Reads CPU attributes
                      PID:1599
                    • /usr/bin/free
                      free -m
                      2⤵
                      • Reads CPU attributes
                      PID:1600
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:1601
                    • /usr/bin/free
                      free -m
                      2⤵
                      • Reads CPU attributes
                      PID:1602
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:1603
                    • /usr/bin/free
                      free -m
                      2⤵
                      • Reads CPU attributes
                      PID:1610
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Reads CPU attributes
                      PID:1611
                    • /usr/bin/free
                      free -m
                      2⤵
                      • Reads CPU attributes
                      PID:1612
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Reads CPU attributes
                      PID:1613
                    • /usr/bin/free
                      free -m
                      2⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:1614
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Reads CPU attributes
                      PID:1615
                    • /usr/bin/free
                      free -m
                      2⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:1616
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:1617
                    • /usr/bin/free
                      free -m
                      2⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:1618
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Reads CPU attributes
                      PID:1619
                    • /usr/bin/free
                      free -m
                      2⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:1620
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Reads CPU attributes
                      PID:1621
                    • /usr/bin/free
                      free -m
                      2⤵
                      • Reads CPU attributes
                      PID:1625
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:1626
                    • /usr/bin/free
                      free -m
                      2⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:1627
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Reads CPU attributes
                      PID:1628
                    • /usr/bin/free
                      free -m
                      2⤵
                      • Reads CPU attributes
                      PID:1629
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:1630

                  Network

                    No results found
                  • 125.53.31.30:2222
                    360 B
                    6
                  • 104.3.109.252:2222
                    360 B
                    6
                  • 73.79.219.171:22
                    360 B
                    6
                  • 156.135.207.184:22
                    360 B
                    6
                  • 139.203.228.41:2222
                    360 B
                    6
                  • 21.209.118.42:2222
                    360 B
                    6
                  • 139.203.228.41:22
                    360 B
                    6
                  • 171.4.21.4:22
                    360 B
                    6
                  • 84.107.169.241:22
                    360 B
                    6
                  • 139.234.110.85:22
                    360 B
                    6
                  • 160.58.180.224:2222
                    360 B
                    6
                  • 111.111.156.141:22
                    360 B
                    6
                  • 151.134.89.192:22
                    360 B
                    6
                  • 116.86.84.100:22
                    360 B
                    6
                  • 221.160.71.207:2222
                    360 B
                    6
                  • 79.53.246.106:22
                    360 B
                    6
                  • 80.155.36.71:22
                    360 B
                    6
                  • 139.234.110.85:2222
                    360 B
                    6
                  • 125.53.31.30:22
                    360 B
                    6
                  • 40.15.243.206:2222
                    360 B
                    6
                  • 244.253.136.88:22
                    360 B
                    6
                  • 138.159.189.179:22
                    360 B
                    6
                  • 139.192.7.174:22
                    360 B
                    6
                  • 173.94.155.231:22
                    360 B
                    6
                  • 218.83.181.143:22
                    360 B
                    6
                  • 128.155.59.215:2222
                    360 B
                    6
                  • 153.181.56.201:22
                    360 B
                    6
                  • 77.123.148.44:2222
                    360 B
                    6
                  • 138.159.189.179:2222
                    360 B
                    6
                  • 156.135.207.184:2222
                    360 B
                    6
                  • 85.136.173.167:2222
                    360 B
                    6
                  • 145.248.227.103:2222
                    360 B
                    6
                  • 79.45.6.185:2222
                    300 B
                    5
                  • 58.127.36.142:22
                    300 B
                    5
                  • 175.192.248.232:2222
                    60 B
                    40 B
                    1
                    1
                  • 218.139.41.110:22
                    300 B
                    5
                  • 115.12.75.172:2222
                    300 B
                    5
                  • 241.225.10.194:2222
                    300 B
                    5
                  • 15.53.96.2:2222
                    300 B
                    5
                  • 113.32.17.197:22
                    300 B
                    5
                  • 53.15.112.13:2222
                    300 B
                    5
                  • 202.132.168.102:22
                    300 B
                    5
                  • 135.43.109.153:2222
                    300 B
                    5
                  • 253.245.19.187:22
                    300 B
                    5
                  • 22.219.53.72:2222
                    300 B
                    5
                  • 15.164.107.205:2222
                    300 B
                    5
                  • 216.39.168.17:2222
                    300 B
                    5
                  • 133.206.173.27:2222
                    300 B
                    5
                  • 128.127.8.179:22
                    300 B
                    5
                  • 174.106.145.75:22
                    300 B
                    5
                  • 21.209.118.42:22
                    300 B
                    5
                  • 21.168.236.177:2222
                    300 B
                    5
                  • 139.192.7.174:2222
                    300 B
                    5
                  • 160.58.180.224:22
                    300 B
                    5
                  • 175.192.248.232:22
                    60 B
                    40 B
                    1
                    1
                  • 51.80.218.62:2222
                    60 B
                    1
                  • 183.154.178.252:2222
                    300 B
                    5
                  • 241.225.10.194:22
                    300 B
                    5
                  • 58.127.36.142:2222
                    300 B
                    5
                  • 154.110.191.222:22
                    300 B
                    5
                  • 211.102.150.87:22
                    300 B
                    5
                  • 253.147.125.50:2222
                    300 B
                    5
                  • 116.86.84.100:2222
                    300 B
                    5
                  • 79.53.246.106:2222
                    300 B
                    5
                  • 218.139.41.110:2222
                    300 B
                    5
                  • 57.1.1.158:2222
                    300 B
                    5
                  • 45.105.19.185:22
                    300 B
                    5
                  • 224.0.0.251:5353
                    146 B
                    2

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/nc

                    Filesize

                    8.7MB

                    MD5

                    76fe4fdd628218f630ba50f91ceba852

                    SHA1

                    6e90f2fe619597115e5b8dd8b0d1fb0c8ad33fa4

                    SHA256

                    041bc20ca8ac3161098cbc976e67e3c0f1b672ad36ecbe22fd21cbd53bcaa742

                    SHA512

                    7956505ae0d8479a92ddf97bb09a757566ef526934ee06b4273f0fc450e4da9204808ffa4f4674f4e6e313eb718a7c65f258ef8d23b9769b8aa12d47610d8011

                  We care about your privacy.

                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.