b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Analysis

max time kernel
149s
max time network
141s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240522.1-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
18-07-2024 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Botnets/FritzFrog/9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
Size

8.6MB
MD5

4842d5cc29c97aa611fba5ca07b060a5
SHA1

f93772038406f28fa4ca1cfb23349193562414b2
SHA256

9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
SHA512

cf1cb3f0291f3e0c3b47ff3ee9074b624e2d9781f9637d14ede0628ebb4b8b0fe13e16583f6a933a3e20872ec084dc812237f021757efe2a6d527a0a1723b5c8
SSDEEP

98304:JcZJWD3qZL7I9lysBfU9OWQcIImfWoezuA+dTlwO0Fz7Xk:JcZJWTqZLGlHsHQl3fNezuAI5g

Score

8^/10

antivm persistence

Malware Config

Signatures

Adds new SSH keys 1 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948

Deletes itself 1 IoCs

pid
1575

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	cat

Reads CPU attributes 1 TTPs 30 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1062/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/962/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/1164/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/535/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/17/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/11/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/1151/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/201/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/956/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/634/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/854/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/1101/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/426/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/13/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/1384/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/94/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/962/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/685/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/7/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/114/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/21/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/852/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/1112/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/426/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/self/auxv	uptime
File opened for reading	/proc/758/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/10/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/734/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/self/auxv	free
File opened for reading	/proc/645/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/110/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/1184/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/19/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/654/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/225/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/417/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/8/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/97/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/1441/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/1570/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/2/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/92/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/113/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/746/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/847/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/971/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/218/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/96/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/1229/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/1436/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/507/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/1016/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/507/cmdline	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
File opened for reading	/proc/1067/stat	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/nc	9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
1⤵
- Adds new SSH keys
- Deletes log files
- Reads runtime system information
- Writes file to tmp directory
PID:1572
- /usr/bin/uname
  uname -a
  2⤵
  PID:1583
- /usr/bin/cat
  cat /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  PID:1584
- /usr/bin/cat
  cat /etc/issue
  2⤵
  PID:1585
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1586
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1587
- /usr/bin/journalctl
  journalctl -S "@0" -u sshd
  2⤵
  PID:1591
- /usr/bin/cat
  cat "/var/log/auth*"
  2⤵
  PID:1592
- /usr/bin/zcat
  zcat "/var/log/auth*"
  2⤵
  PID:1593
- /usr/local/sbin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1593
- /usr/local/bin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1593
- /usr/sbin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1593
- /usr/bin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1593
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1594
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1595
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1596
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1597
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1600
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1601
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1602
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1603
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1604
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1605
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1606
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1607
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1608
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1609
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1610
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1611
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1612
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1613
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1614
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1615
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1616
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1617
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1621
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1622
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1623
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1624
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1625
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1626

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/nc

Filesize
8.6MB

MD5
4842d5cc29c97aa611fba5ca07b060a5

SHA1
f93772038406f28fa4ca1cfb23349193562414b2

SHA256
9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948

SHA512
cf1cb3f0291f3e0c3b47ff3ee9074b624e2d9781f9637d14ede0628ebb4b8b0fe13e16583f6a933a3e20872ec084dc812237f021757efe2a6d527a0a1723b5c8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads