b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Analysis

max time kernel
149s
max time network
146s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
04-09-2024 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Botnets/FritzFrog/30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
Size

8.6MB
MD5

819b0fdb2b9c8a440b734a7b72522f12
SHA1

f3aff7e1c44d21508eb60797211570c84a53597a
SHA256

30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
SHA512

fee2c0dbbc91e2486e409e8b6a877c6ec500e6c7c0491d4c44d37006c30de79b95dd4640c7c8c8efcc920abccbdb659a590fde1e2526126279b7486778d08b5a
SSDEEP

98304:zhPTaS9ki2kJxOU/ci9Z6uHFg3+QIEvRihdF7Xk:dPTaS9kitnEi9Z6uHq3+XE8z

Score

8^/10

antivm defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Adds new SSH keys 1 TTPs 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
persistence privilege_escalation

SSH Authorized Keys
T1098.004

Processes:

30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01

description ioc process

File opened for modification /root/.ssh/authorized_keys 30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
Deletes itself 1 IoCs

Processes:

30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01

pid process

2460 30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01

description	ioc	process
File opened for modification	/root/.ssh/authorized_keys	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01

pid	process
2460	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

Processes:

30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01

description	ioc	process
File deleted	/var/log/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01

Enumerates running processes
Discovers information about currently running processes on the system
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

System Checks
T1497.001

Processes:

cat

description ioc process

File opened for reading /proc/cpuinfo cat

description	ioc	process
File opened for reading	/proc/cpuinfo	cat

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01uptimefreefreefreejournalctluptime

description	ioc	process
File opened for reading	/proc/275/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/46/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/588/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/1756/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/9/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/1821/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/11/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/10/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/1123/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/26/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/18/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/65/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/80/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/7/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/14/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/1899/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/46/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/1764/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/54/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/442/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/2459/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/20/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/2456/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/2090/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/196/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/2170/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/34/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/1957/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/1843/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/193/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/35/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/47/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/1930/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/1046/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/1888/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/40/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/1644/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/21/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/22/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/2456/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/1900/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/2048/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/27/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/51/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/193/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/1915/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/1954/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/sys/kernel/cap_last_cap	journalctl
File opened for reading	/proc/1092/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/2154/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/1397/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/29/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/4/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/191/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/2079/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/2177/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/35/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/386/cmdline	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
File opened for reading	/proc/1744/stat	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

Processes:

30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01

description	ioc	process
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/nc	30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
1⤵
- Adds new SSH keys
- Deletes itself
- Deletes log files
- Reads runtime system information
- Writes file to tmp directory
PID:2460

/usr/bin/uname
uname -a
2⤵
PID:2472

/usr/bin/cat
cat /proc/cpuinfo
2⤵
- Checks CPU configuration
PID:2475

/usr/bin/cat
cat /etc/issue
2⤵
PID:2478

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:2479

/usr/bin/uptime
uptime
2⤵
PID:2480

/usr/bin/journalctl
journalctl -S "@0" -u sshd
2⤵
- Reads runtime system information
PID:2481

/usr/bin/cat
cat "/var/log/auth*"
2⤵
PID:2483

/usr/bin/zcat
zcat "/var/log/auth*"
2⤵
PID:2484

/usr/local/sbin/gzip
gzip -cd "/var/log/auth*"
2⤵
PID:2484

/usr/local/bin/gzip
gzip -cd "/var/log/auth*"
2⤵
PID:2484

/usr/sbin/gzip
gzip -cd "/var/log/auth*"
2⤵
PID:2484

/usr/bin/gzip
gzip -cd "/var/log/auth*"
2⤵
PID:2484

/usr/bin/free
free -m
2⤵
PID:2485

/usr/bin/uptime
uptime
2⤵
PID:2486

/usr/bin/free
free -m
2⤵
PID:2487

/usr/bin/uptime
uptime
2⤵
PID:2488

/usr/bin/free
free -m
2⤵
PID:2492

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:2493

/usr/bin/free
free -m
2⤵
PID:2494

/usr/bin/uptime
uptime
2⤵
PID:2495

/usr/bin/free
free -m
2⤵
PID:2496

/usr/bin/uptime
uptime
2⤵
PID:2497

/usr/bin/free
free -m
2⤵
PID:2498

/usr/bin/uptime
uptime
2⤵
PID:2499

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:2500

/usr/bin/uptime
uptime
2⤵
PID:2501

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:2502

/usr/bin/uptime
uptime
2⤵
PID:2503

/usr/bin/free
free -m
2⤵
PID:2504

/usr/bin/uptime
uptime
2⤵
PID:2505

/usr/bin/free
free -m
2⤵
PID:2506

/usr/bin/uptime
uptime
2⤵
PID:2507

/usr/bin/free
free -m
2⤵
PID:2508

/usr/bin/uptime
uptime
2⤵
PID:2509

/usr/bin/free
free -m
2⤵
PID:2524

/usr/bin/uptime
uptime
2⤵
PID:2525

/usr/bin/free
free -m
2⤵
PID:2529

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:2530

/usr/bin/free
free -m
2⤵
PID:2531

/usr/bin/uptime
uptime
2⤵
PID:2532

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/nc
Filesize
8.6MB

MD5
819b0fdb2b9c8a440b734a7b72522f12

SHA1
f3aff7e1c44d21508eb60797211570c84a53597a

SHA256
30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01

SHA512
fee2c0dbbc91e2486e409e8b6a877c6ec500e6c7c0491d4c44d37006c30de79b95dd4640c7c8c8efcc920abccbdb659a590fde1e2526126279b7486778d08b5a

Download Submit