Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    18-07-2024 21:48

General

  • Target

    The-MALWARE-Repo-master/Botnets/FritzFrog/7745b070943e910e8807e3521ac7b7a01401d131bf6c18a63433f8177ed539a6

  • Size

    8.7MB

  • MD5

    d4e533f9c11b5cc9e755d94c1315553a

  • SHA1

    9e15020cd2688b537bae18e5f291ee8cbe9a85e7

  • SHA256

    7745b070943e910e8807e3521ac7b7a01401d131bf6c18a63433f8177ed539a6

  • SHA512

    149226355b2e5c3fac403289b5e66bd4164a7aee76d8dc8f1d698c509db7a081bad9d4172cc950bb0e6e6909e0073d551dcde82cbeaaf61a9c1b02c9ba48fb38

  • SSDEEP

    98304:H27or8Dynb9c4EHv9/fW/NQXPvTCaedQuMBiHAUU4C7Xk:H27or8DyO4UnwQfvTCXdQuMoUj

Score
8/10

Malware Config

Signatures

  • Adds new SSH keys 1 IoCs

    Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

  • Deletes itself 1 IoCs
  • Deletes log files 1 TTPs 1 IoCs

    Deletes log files on the system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 30 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/7745b070943e910e8807e3521ac7b7a01401d131bf6c18a63433f8177ed539a6
    /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/7745b070943e910e8807e3521ac7b7a01401d131bf6c18a63433f8177ed539a6
    1⤵
    • Adds new SSH keys
    • Deletes log files
    • Reads runtime system information
    PID:1502
    • /bin/uname
      uname -a
      2⤵
        PID:1513
      • /bin/cat
        cat /proc/cpuinfo
        2⤵
        • Checks CPU configuration
        PID:1514
      • /bin/cat
        cat /etc/issue
        2⤵
          PID:1518
        • /usr/bin/free
          free -m
          2⤵
          • Reads CPU attributes
          PID:1519
        • /usr/bin/uptime
          uptime
          2⤵
          • Reads CPU attributes
          PID:1520
        • /bin/journalctl
          journalctl -S "@0" -u sshd
          2⤵
          • Reads runtime system information
          PID:1521
        • /bin/cat
          cat "/var/log/auth*"
          2⤵
            PID:1522
          • /bin/zcat
            zcat "/var/log/auth*"
            2⤵
              PID:1523
            • /bin/gzip
              gzip -cd "/var/log/auth*"
              2⤵
                PID:1523
              • /usr/bin/free
                free -m
                2⤵
                • Reads CPU attributes
                • Reads runtime system information
                PID:1527
              • /usr/bin/uptime
                uptime
                2⤵
                • Reads CPU attributes
                PID:1528
              • /usr/bin/free
                free -m
                2⤵
                • Reads CPU attributes
                • Reads runtime system information
                PID:1529
              • /usr/bin/uptime
                uptime
                2⤵
                • Reads CPU attributes
                PID:1530
              • /usr/bin/free
                free -m
                2⤵
                • Reads CPU attributes
                PID:1533
              • /usr/bin/uptime
                uptime
                2⤵
                • Reads CPU attributes
                • Reads runtime system information
                PID:1534
              • /usr/bin/free
                free -m
                2⤵
                • Reads CPU attributes
                PID:1535
              • /usr/bin/uptime
                uptime
                2⤵
                • Reads CPU attributes
                PID:1536
              • /usr/bin/free
                free -m
                2⤵
                • Reads CPU attributes
                PID:1537
              • /usr/bin/uptime
                uptime
                2⤵
                • Reads CPU attributes
                PID:1538
              • /usr/bin/free
                free -m
                2⤵
                • Reads CPU attributes
                PID:1539
              • /usr/bin/uptime
                uptime
                2⤵
                • Reads CPU attributes
                PID:1540
              • /usr/bin/free
                free -m
                2⤵
                • Reads CPU attributes
                • Reads runtime system information
                PID:1541
              • /usr/bin/uptime
                uptime
                2⤵
                • Reads CPU attributes
                PID:1542
              • /usr/bin/free
                free -m
                2⤵
                • Reads CPU attributes
                • Reads runtime system information
                PID:1543
              • /usr/bin/uptime
                uptime
                2⤵
                • Reads CPU attributes
                • Reads runtime system information
                PID:1544
              • /usr/bin/free
                free -m
                2⤵
                • Reads CPU attributes
                PID:1545
              • /usr/bin/uptime
                uptime
                2⤵
                • Reads CPU attributes
                • Reads runtime system information
                PID:1546
              • /usr/bin/free
                free -m
                2⤵
                • Reads CPU attributes
                PID:1547
              • /usr/bin/uptime
                uptime
                2⤵
                • Reads CPU attributes
                PID:1548
              • /usr/bin/free
                free -m
                2⤵
                • Reads CPU attributes
                PID:1549
              • /usr/bin/uptime
                uptime
                2⤵
                • Reads CPU attributes
                PID:1550
              • /usr/bin/free
                free -m
                2⤵
                • Reads CPU attributes
                PID:1551
              • /usr/bin/uptime
                uptime
                2⤵
                • Reads CPU attributes
                PID:1552
              • /usr/bin/free
                free -m
                2⤵
                • Reads CPU attributes
                • Reads runtime system information
                PID:1553
              • /usr/bin/uptime
                uptime
                2⤵
                • Reads CPU attributes
                PID:1554
              • /usr/bin/free
                free -m
                2⤵
                • Reads CPU attributes
                • Reads runtime system information
                PID:1555
              • /usr/bin/uptime
                uptime
                2⤵
                • Reads CPU attributes
                PID:1556

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • /root/.ssh/authorized_keys

              Filesize

              381B

              MD5

              9da18d38b6dd4c4aa84642378d63fa89

              SHA1

              c5a976691e4b5963b5e760044f22cc9685268db6

              SHA256

              43062900b2539d8d1f67f30fa7042c56b53541f63875b5f0de5d8fbde0e0a8bf

              SHA512

              222b20b5b2ff8956c13dbac1f8d3f81435613b751913d65f4c4082ea9c1a7c8ae91be17a24ef4ae0c708bfe09daab552bb209615714d70acfaaed89c536c71b3