Analysis
-
max time kernel
149s -
max time network
154s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
18-07-2024 21:48
General
-
Target
The-MALWARE-Repo-master/Botnets/FritzFrog/2378e76aba1ad6e0c937fb39989217bf0de616fdad4726c0f4233bf5414cde86
-
Size
8.7MB
-
MD5
3a371a09bfcba3d545465339f1e1d481
-
SHA1
7f5712878929aab6a2ab297072a5a5f3d3c15a01
-
SHA256
2378e76aba1ad6e0c937fb39989217bf0de616fdad4726c0f4233bf5414cde86
-
SHA512
35efc5129316ea697f1f4591c37e70c74b643942cdb3cb1aac6a0f14f5d133da39c0c393439490bc059361e9feeacee3d4056f88700f56dfe1088ba0ab22613b
-
SSDEEP
98304:f/VrKprvLVtb8E0dD71puy219CZ2gT3/3Khbw+Aw:3VrKpjROndH1puy219CZBShb
Malware Config
Signatures
-
Adds new SSH keys 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
-
Deletes itself 1 IoCs
-
Deletes log files 1 TTPs 1 IoCs
Deletes log files on the system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/2378e76aba1ad6e0c937fb39989217bf0de616fdad4726c0f4233bf5414cde86/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/2378e76aba1ad6e0c937fb39989217bf0de616fdad4726c0f4233bf5414cde861⤵
- Adds new SSH keys
- Deletes itself
- Deletes log files
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
-
/usr/bin/unameuname -a2⤵
-
-
/usr/bin/catcat /proc/cpuinfo2⤵
- Checks CPU configuration
-
-
/usr/bin/catcat /etc/issue2⤵
-
-
/usr/bin/freefree -m2⤵
- Reads runtime system information
-
-
/usr/bin/uptimeuptime2⤵
- Reads runtime system information
-
-
/usr/bin/journalctljournalctl -S "@0" -u sshd2⤵
-
-
/usr/bin/catcat "/var/log/auth*"2⤵
-
-
/usr/bin/zcatzcat "/var/log/auth*"2⤵
-
-
/usr/local/sbin/gzipgzip -cd "/var/log/auth*"2⤵
-
-
/usr/local/bin/gzipgzip -cd "/var/log/auth*"2⤵
-
-
/usr/sbin/gzipgzip -cd "/var/log/auth*"2⤵
-
-
/usr/bin/gzipgzip -cd "/var/log/auth*"2⤵
-
-
/usr/bin/freefree -m2⤵
-
-
/usr/bin/uptimeuptime2⤵
- Reads runtime system information
-
-
/usr/bin/freefree -m2⤵
-
-
/usr/bin/uptimeuptime2⤵
-
-
/usr/bin/freefree -m2⤵
-
-
/usr/bin/uptimeuptime2⤵
- Reads runtime system information
-
-
/usr/bin/freefree -m2⤵
-
-
/usr/bin/uptimeuptime2⤵
- Reads runtime system information
-
-
/usr/bin/freefree -m2⤵
-
-
/usr/bin/uptimeuptime2⤵
-
-
/usr/bin/freefree -m2⤵
-
-
/usr/bin/uptimeuptime2⤵
- Reads runtime system information
-
-
/usr/bin/freefree -m2⤵
-
-
/usr/bin/uptimeuptime2⤵
-
-
/usr/bin/freefree -m2⤵
-
-
/usr/bin/uptimeuptime2⤵
-
-
/usr/bin/freefree -m2⤵
- Reads runtime system information
-
-
/usr/bin/uptimeuptime2⤵
-
-
/usr/bin/freefree -m2⤵
-
-
/usr/bin/uptimeuptime2⤵
-
-
/usr/bin/freefree -m2⤵
-
-
/usr/bin/uptimeuptime2⤵
-
-
/usr/bin/freefree -m2⤵
- Reads runtime system information
-
-
/usr/bin/uptimeuptime2⤵
-
-
/usr/bin/freefree -m2⤵
-
-
/usr/bin/uptimeuptime2⤵
-
-
/usr/bin/freefree -m2⤵
-
-
/usr/bin/uptimeuptime2⤵
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.7MB
MD53a371a09bfcba3d545465339f1e1d481
SHA17f5712878929aab6a2ab297072a5a5f3d3c15a01
SHA2562378e76aba1ad6e0c937fb39989217bf0de616fdad4726c0f4233bf5414cde86
SHA51235efc5129316ea697f1f4591c37e70c74b643942cdb3cb1aac6a0f14f5d133da39c0c393439490bc059361e9feeacee3d4056f88700f56dfe1088ba0ab22613b