b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Analysis

max time kernel
149s
max time network
148s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
18-07-2024 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Botnets/FritzFrog/7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
Size

8.7MB
MD5

b2e0eede7b18253dccd0d44ebb5db85a
SHA1

ee5db9590090efd5549e1c17ec1ee956ef1ed3d1
SHA256

7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
SHA512

5608fe7bde5072de7c98bacfe7beb928e6073be87c0fbccd8075c808d9a7c642abe254f6eb620d627f5324e35821fc9b41a31970264abcc472adfbe2c214a9fe
SSDEEP

98304:zbc+G4RTwJg0GTvmF3D4cQ1XmkPF0ihOehaOE3Ok7Xk:zbc+G4RTwJGOzfQYkPGihOekj

Score

8^/10

antivm persistence

Malware Config

Signatures

Adds new SSH keys 1 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd

Deletes itself 1 IoCs

pid	Process
2491	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	cat

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/2196/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/191/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/1058/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/2484/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/2168/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/29/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1109/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/53/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1391/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/14/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1113/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1115/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/721/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1390/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1791/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1974/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/17/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1940/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/13/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1390/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/2118/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/2483/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/28/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/2130/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/54/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1896/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/2491/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/2512/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1938/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/23/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1756/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/45/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/1868/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/275/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/2481/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/199/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/182/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1850/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1930/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/2545/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1681/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/43/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/2070/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/190/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/37/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/436/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/760/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1058/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/13/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1923/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/17/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/2183/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/1946/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1659/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/2077/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/filesystems	journalctl
File opened for reading	/proc/189/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/55/cmdline	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
File opened for reading	/proc/1247/stat	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/nc	7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
1⤵
- Adds new SSH keys
- Deletes itself
- Deletes log files
- Reads runtime system information
- Writes file to tmp directory
PID:2491
- /usr/bin/uname
  uname -a
  2⤵
  PID:2506
- /usr/bin/cat
  cat /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  PID:2507
- /usr/bin/cat
  cat /etc/issue
  2⤵
  PID:2509
- /usr/bin/free
  free -m
  2⤵
  PID:2510
- /usr/bin/uptime
  uptime
  2⤵
  PID:2511
- /usr/bin/journalctl
  journalctl -S "@0" -u sshd
  2⤵
  - Reads runtime system information
  PID:2512
- /usr/bin/cat
  cat "/var/log/auth*"
  2⤵
  PID:2514
- /usr/bin/zcat
  zcat "/var/log/auth*"
  2⤵
  PID:2515
- /usr/local/sbin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:2515
- /usr/local/bin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:2515
- /usr/sbin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:2515
- /usr/bin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:2515
- /usr/bin/free
  free -m
  2⤵
  PID:2516
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:2517
- /usr/bin/free
  free -m
  2⤵
  PID:2518
- /usr/bin/uptime
  uptime
  2⤵
  PID:2519
- /usr/bin/free
  free -m
  2⤵
  PID:2523
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:2524
- /usr/bin/free
  free -m
  2⤵
  PID:2525
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:2526
- /usr/bin/free
  free -m
  2⤵
  PID:2527
- /usr/bin/uptime
  uptime
  2⤵
  PID:2528
- /usr/bin/free
  free -m
  2⤵
  PID:2529
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:2530
- /usr/bin/free
  free -m
  2⤵
  PID:2531
- /usr/bin/uptime
  uptime
  2⤵
  PID:2532
- /usr/bin/free
  free -m
  2⤵
  PID:2533
- /usr/bin/uptime
  uptime
  2⤵
  PID:2534
- /usr/bin/free
  free -m
  2⤵
  PID:2536
- /usr/bin/uptime
  uptime
  2⤵
  PID:2537
- /usr/bin/free
  free -m
  2⤵
  PID:2538
- /usr/bin/uptime
  uptime
  2⤵
  PID:2539
- /usr/bin/free
  free -m
  2⤵
  PID:2540
- /usr/bin/uptime
  uptime
  2⤵
  PID:2541
- /usr/bin/free
  free -m
  2⤵
  PID:2557
- /usr/bin/uptime
  uptime
  2⤵
  PID:2558
- /usr/bin/free
  free -m
  2⤵
  PID:2562
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:2563
- /usr/bin/free
  free -m
  2⤵
  PID:2564
- /usr/bin/uptime
  uptime
  2⤵
  PID:2565

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/nc

Filesize
8.7MB

MD5
b2e0eede7b18253dccd0d44ebb5db85a

SHA1
ee5db9590090efd5549e1c17ec1ee956ef1ed3d1

SHA256
7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd

SHA512
5608fe7bde5072de7c98bacfe7beb928e6073be87c0fbccd8075c808d9a7c642abe254f6eb620d627f5324e35821fc9b41a31970264abcc472adfbe2c214a9fe

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads