Overview

overview

7

Static

static

5

pty

ubuntu-24.04-amd64

7

Resubmissions

27/10/2024, 12:07

241027-paembsvpgt7

20/10/2024, 08:21

241020-j835pazflk7

Analysis

  • max time kernel
    1s
  • max time network
    128s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    27/10/2024, 12:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    pty
  • Size 43KB
  • Sample241027-paembsvpgt
  • SHA256 d6f7fa3acf502d0b6e11197d80d305748999225be6f4eaf28e05a7c94facd432
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalatiorootkit

Malware Config

Signatures

  • Loads a kernel module 2 IoCs

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Indicator Removal: Timestomp 1 TTPs 1 IoCs

    Adversaries may remove indicators of compromise from the host to evade detection.

    defense_evasion
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/pty
    /tmp/pty
    1⤵
    • Loads a kernel module
    PID:2474
    • /usr/bin/killall
      killall -9 mips
      2⤵
      • Reads runtime system information
      • System Network Configuration Discovery
      PID:2485
    • /usr/bin/killall
      killall -9 ppc
      2⤵
      • Reads runtime system information
      PID:2491
    • /usr/bin/killall
      killall -9 daemon.i686.mod
      2⤵
      • Reads runtime system information
      PID:2495
    • /usr/bin/killall
      killall -9 daemon.mips.mod
      2⤵
      • Reads runtime system information
      • System Network Configuration Discovery
      PID:2497
    • /usr/bin/killall
      killall -9 daemon.mipsel.mod
      2⤵
      • Reads runtime system information
      • System Network Configuration Discovery
      PID:2499
    • /usr/bin/cat
      cat "/tmp/.xs/*.pid"
      2⤵
        PID:2502
      • /usr/bin/rm
        rm -rf "/tmp/.xs/*"
        2⤵
          PID:2504
        • /usr/bin/touch
          touch -acmr /bin/ls /tmp/pty
          2⤵
          • Indicator Removal: Timestomp
          PID:2506
        • /usr/bin/crontab
          crontab -l
          2⤵
            PID:2510
          • /usr/bin/grep
            grep -v /tmp/pty
            2⤵
              PID:2511
            • /usr/bin/grep
              grep -v "no cron"
              2⤵
                PID:2512
              • /usr/bin/grep
                grep -v lesshts/run.sh
                2⤵
                  PID:2515
                • /usr/bin/crontab
                  crontab /var/run/.x001804289383
                  2⤵
                  • Creates/modifies Cron job
                  PID:2518
                • /usr/bin/rm
                  rm -rf /var/run/.x001804289383
                  2⤵
                    PID:2520
                  • /bin/uname
                    /bin/uname -n
                    2⤵
                      PID:2522
                    • /bin/uname
                      /bin/uname -n
                      2⤵
                        PID:2524
                    • /usr/bin/rm
                      rm -rf /var/run/wgsh
                      1⤵
                        PID:2477
                      • /usr/bin/rm
                        rm -rf /var/run/bbsh
                        1⤵
                          PID:2479
                        • /usr/bin/rm
                          rm -rf /var/run/pty
                          1⤵
                            PID:2481
                          • /usr/bin/killall
                            killall -9 arm
                            1⤵
                            • Reads runtime system information
                            PID:2483
                          • /usr/bin/killall
                            killall -9 mipsel
                            1⤵
                            • Reads runtime system information
                            • System Network Configuration Discovery
                            PID:2487
                          • /usr/bin/killall
                            killall -9 powerpc
                            1⤵
                            • Reads runtime system information
                            PID:2489
                          • /usr/bin/killall
                            killall -9 daemon.armv4l.mod
                            1⤵
                            • Reads runtime system information
                            PID:2493

                          Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                .x001804289383
                                • Path /run/.x001804289383
                                • Size 38B
                                • SHA256 148d28c51d555a0806e90409c096e98b23196413a2a7fe91cc9a2ec2b3f40af8
                                • MD5 SHA1 SHA512
                                Submit Download

                                tmp.EZap0h
                                • Path /var/spool/cron/crontabs/tmp.EZap0h
                                • Size 235B
                                • SHA256 6f5598a838a03c0ded5af053bcab9605f5a8db22a9239a533089c7480d7f5ab9
                                • MD5 SHA1 SHA512
                                Submit Download