7e3ff687063d2a52607b68f60f46ff7cd918ca21af2df36da7d2f91e9324b970

Resubmissions

01-11-2024 18:06

241101-wp5wdsvnel 4

01-11-2024 16:27

241101-tx4bes1lcx 4

01-11-2024 16:24

241101-twjkma1lb1 7

Analysis

max time kernel
299s
max time network
304s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240611-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
01-11-2024 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sshx
Size

7.3MB
MD5

4655941d7ea27788f29e7101794a24bb
SHA1

e8605a27857832503bacfbe106eaf2a02361b5e3
SHA256

9d7ad8da8ce2bcdbbe2164e37d5759c9efc22e68ddc11f4502c43b14b349bdec
SHA512

0a8011b87021dd9b5d0350b38ba7d8e837833405b95a8762b7b8833800327470a2c1b0b5e1b5101a8448ba3531123e04502759be43fb96860616623973f7e43e
SSDEEP

98304:GpitswbS0eSojJ5+NfoIVoKCT5K+dmcF:GUsKS0eeBHc

Score

4^/10

discovery

Malware Config

Signatures

Changes its process name 8 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	1402	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	1401	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	1404	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	1403	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	1462	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	1463	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	1587	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	1588	sshx

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/cpu/cpu.cfs_quota_us	sshx
File opened for reading	/sys/fs/cgroup/cpu/cpu.cfs_period_us	sshx

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/cgroup	sshx

/tmp/sshx
/tmp/sshx
1⤵
- Changes its process name
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads