b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Analysis

max time kernel
149s
max time network
157s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
18-07-2024 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Botnets/FritzFrog/90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
Size

8.7MB
MD5

100bff2f4ee4d88b005bb016daa04fe6
SHA1

36e5f8f70890601aa2adaffb203afd06516097f0
SHA256

90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
SHA512

a1cb52bc6edaa7f8bb216d2a5f3deb0b8468c64b43931ef570c05e6a9872c63f00aff50d69686fdc2ea25d3d83da4bf9d78f5e6910643163570d0bd6279c6e16
SSDEEP

98304:wRINZeR9Zy031d3eDi2dZQT3/S1GVlOre53ziKZ7Xk:wRINZeR9Zx1CFDQD/SQVlOrKr

Score

8^/10

antivm persistence

Malware Config

Signatures

Adds new SSH keys 1 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5

Deletes itself 1 IoCs

pid	Process
4064	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	cat

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/4074/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/883/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3590/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3280/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/6/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/48/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/52/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/199/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/28/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3872/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/3364/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/775/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/36/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3830/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/2/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3501/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/1406/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/51/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/192/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/21/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/20/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/33/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/40/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/834/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3570/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/34/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3572/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3567/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3501/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/13/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3453/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3556/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/197/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3518/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3550/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/4/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/30/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3793/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/40/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/2563/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/46/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/186/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3723/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/4003/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/11/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/181/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3450/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3852/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/196/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/274/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3282/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/4064/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3566/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/54/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/43/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/590/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/437/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/1405/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/181/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/3768/stat	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
File opened for reading	/proc/45/cmdline	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/nc	90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
1⤵
- Adds new SSH keys
- Deletes itself
- Deletes log files
- Reads runtime system information
- Writes file to tmp directory
PID:4064
- /usr/bin/uname
  uname -a
  2⤵
  PID:4084
- /usr/bin/cat
  cat /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  PID:4085
- /usr/bin/cat
  cat /etc/issue
  2⤵
  PID:4086
- /usr/bin/free
  free -m
  2⤵
  PID:4087
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:4088
- /usr/bin/journalctl
  journalctl -S "@0" -u sshd
  2⤵
  PID:4089
- /usr/bin/cat
  cat "/var/log/auth*"
  2⤵
  PID:4091
- /usr/bin/zcat
  zcat "/var/log/auth*"
  2⤵
  PID:4092
- /usr/local/sbin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:4092
- /usr/local/bin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:4092
- /usr/sbin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:4092
- /usr/bin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:4092
- /usr/bin/free
  free -m
  2⤵
  PID:4093
- /usr/bin/uptime
  uptime
  2⤵
  PID:4094
- /usr/bin/free
  free -m
  2⤵
  PID:4095
- /usr/bin/uptime
  uptime
  2⤵
  PID:4096
- /usr/bin/free
  free -m
  2⤵
  - Reads runtime system information
  PID:4100
- /usr/bin/uptime
  uptime
  2⤵
  PID:4101
- /usr/bin/free
  free -m
  2⤵
  PID:4120
- /usr/bin/uptime
  uptime
  2⤵
  PID:4121
- /usr/bin/free
  free -m
  2⤵
  PID:4122
- /usr/bin/uptime
  uptime
  2⤵
  PID:4123
- /usr/bin/free
  free -m
  2⤵
  PID:4124
- /usr/bin/uptime
  uptime
  2⤵
  PID:4125
- /usr/bin/free
  free -m
  2⤵
  PID:4126
- /usr/bin/uptime
  uptime
  2⤵
  PID:4127
- /usr/bin/free
  free -m
  2⤵
  PID:4128
- /usr/bin/uptime
  uptime
  2⤵
  PID:4129
- /usr/bin/free
  free -m
  2⤵
  - Reads runtime system information
  PID:4130
- /usr/bin/uptime
  uptime
  2⤵
  PID:4131
- /usr/bin/free
  free -m
  2⤵
  PID:4132
- /usr/bin/uptime
  uptime
  2⤵
  PID:4133
- /usr/bin/free
  free -m
  2⤵
  PID:4134
- /usr/bin/uptime
  uptime
  2⤵
  PID:4135
- /usr/bin/free
  free -m
  2⤵
  PID:4136
- /usr/bin/uptime
  uptime
  2⤵
  PID:4137
- /usr/bin/free
  free -m
  2⤵
  PID:4138
- /usr/bin/uptime
  uptime
  2⤵
  PID:4139
- /usr/bin/free
  free -m
  2⤵
  PID:4140
- /usr/bin/uptime
  uptime
  2⤵
  PID:4141

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/nc

Filesize
8.7MB

MD5
100bff2f4ee4d88b005bb016daa04fe6

SHA1
36e5f8f70890601aa2adaffb203afd06516097f0

SHA256
90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5

SHA512
a1cb52bc6edaa7f8bb216d2a5f3deb0b8468c64b43931ef570c05e6a9872c63f00aff50d69686fdc2ea25d3d83da4bf9d78f5e6910643163570d0bd6279c6e16

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads