Resubmissions
22/07/2024, 00:23
240722-aptmgascrb322/07/2024, 00:16
240722-akq1savbpm422/07/2024, 00:05
240722-adlgqa1gmh3Analysis
- max time kernel
0s - max time network
480s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20240611-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
22/07/2024, 00:23
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://149.154.167.99
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
2 signatures
1800 seconds
Behavioral task
behavioral2
Sample
http://149.154.167.99
Resource
debian9-armhf-20240611-en
debian-9-armhf
0 signatures
1800 seconds
Behavioral task
behavioral3
Sample
http://149.154.167.99
Resource
debian9-mipsbe-20240611-en
debian-9-mips
0 signatures
1800 seconds
Behavioral task
behavioral4
Sample
http://149.154.167.99
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
0 signatures
1800 seconds
General
- Target http://149.154.167.99
- Sample240722-aptmgascrb
Score
3/10
Malware Config
Signatures
- Enumerates kernel/hardware configuration 1 TTPs 46 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices/0000:00:02.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/device firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/class firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/class firefox File opened for reading /sys/bus/pci/devices firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/class firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/resource firefox - Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/self/task/1518/stat firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/filesystems firefox