c3af157e2f92dcccc5d8a28ccdad214f4cd20f4a7530e73c49a11b01ebf051d7

Analysis

max time kernel
149s
max time network
149s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
19-10-2024 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nps/npc
Size

11.5MB
MD5

64cc88ff3f8735ee8b0a6687c84dee1d
SHA1

2a097acbf4bf132f0bb6de7ea33f42b3292f5001
SHA256

4714e8ad9c625070ca0a151ffc98d87d8e5da7c8ef42037ca5f43baede6cfac1
SHA512

179e1ce166dd76ccbf155cb96293401e05763b2ea5c133497fd76aceac9df6a991063b63eeeedf426ad12e566677ee5340ac433fdd3469fdce0110c24cd00548
SSDEEP

196608:1WTV+5v5ScZK3O48F9zV3pnFeXRBzV3ka0JuP:10V+53XF9zcH1ka0

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
discovery

System Information Discovery
T1082

Processes:

npc

description ioc process

File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size npc
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
discovery

Processes:

npc

description ioc process

File opened for reading /proc/stat npc
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

npc

description ioc process

File opened for modification /tmp/npc_vkey.txt npc

description	ioc	process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	npc

description	ioc	process
File opened for reading	/proc/stat	npc

description	ioc	process
File opened for modification	/tmp/npc_vkey.txt	npc

/tmp/nps/npc
/tmp/nps/npc
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:3637

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/npc_vkey.txt

Filesize
16B

MD5
2ce6c29ffa79fa5744d071f9f7d5d7f5

SHA1
c168995cb829d88fd5f71f5d229cdff9f9cc9baa

SHA256
615212952605a6dcbc4e202cb094d3d436e49671cd6fc24dd4feb221c4866d9b

SHA512
5da966f0a08e727e1f38444b97a3d79376734dfe8f5293a3d3e7201df427a2586f03b251832627f68a8b260296bbb42404fc08f1c03a61fc1aabb452ab4f924c

Download Submit