0de9266af49aab24256c289d39e86649d978d5a4c9d0ff2041a22140b88ea688

Submit
Reports

Overview

overview

Static

static

.systemd/.i686

ubuntu-22.04-amd64

.systemd/.run

ubuntu-18.04-amd64

.systemd/.run

debian-9-armhf

.systemd/.run

debian-9-mips

.systemd/.run

debian-9-mipsel

.systemd/.x86_64

ubuntu-24.04-amd64

.systemd/auto

ubuntu-18.04-amd64

.systemd/auto

debian-9-armhf

.systemd/auto

debian-9-mips

.systemd/auto

debian-9-mipsel

.systemd/clean

ubuntu-18.04-amd64

.systemd/clean

debian-9-armhf

.systemd/clean

debian-9-mips

.systemd/clean

debian-9-mipsel

.systemd/go

ubuntu-18.04-amd64

.systemd/go

debian-9-armhf

.systemd/go

debian-9-mips

.systemd/go

debian-9-mipsel

.systemd/ntpdate

ubuntu-18.04-amd64

.systemd/ntpdate

debian-9-armhf

.systemd/ntpdate

debian-9-mips

.systemd/ntpdate

debian-9-mipsel

.update/.i686

ubuntu-20.04-amd64

.update/.run

ubuntu-18.04-amd64

.update/.run

debian-9-armhf

.update/.run

debian-9-mips

.update/.run

debian-9-mipsel

.update/.x86_64

ubuntu-22.04-amd64

.update/auth

ubuntu-18.04-amd64

.update/auth

debian-9-armhf

.update/auth

debian-9-mips

.update/auth

debian-9-mipsel

Analysis

max time kernel
1s
max time network
132s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
08-11-2024 11:36

Sharing

Copy URL

Twitter E-mail

Static task

static1

upx

1 signatures

Behavioral task

behavioral1

Sample

.systemd/.i686

Resource

ubuntu2204-amd64-20240611-en

discovery

ubuntu-22.04-amd64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

.systemd/.run

Resource

ubuntu1804-amd64-20240508-en

discovery upx

ubuntu-18.04-amd64

6 signatures

150 seconds

Behavioral task

behavioral3

Sample

.systemd/.run

Resource

debian9-armhf-20240611-en

discovery

debian-9-armhf

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

.systemd/.run

Resource

debian9-mipsbe-20240729-en

discovery

debian-9-mips

4 signatures

150 seconds

Behavioral task

behavioral5

Sample

.systemd/.run

Resource

debian9-mipsel-20240611-en

discovery

debian-9-mipsel

4 signatures

150 seconds

Behavioral task

behavioral6

Sample

.systemd/.x86_64

Resource

ubuntu2404-amd64-20240523-en

kaiten botnet discovery

ubuntu-24.04-amd64

6 signatures

150 seconds

Behavioral task

behavioral7

Sample

.systemd/auto

Resource

ubuntu1804-amd64-20240508-en

defense_evasion execution persistence privilege_escalatio

ubuntu-18.04-amd64

3 signatures

150 seconds

Behavioral task

behavioral8

Sample

.systemd/auto

Resource

debian9-armhf-20240611-en

defense_evasion discovery execution persistence privilege_escalatio

debian-9-armhf

4 signatures

150 seconds

Behavioral task

behavioral9

Sample

.systemd/auto

Resource

debian9-mipsbe-20240729-en

defense_evasion discovery execution persistence privilege_escalatio

debian-9-mips

4 signatures

150 seconds

Behavioral task

behavioral10

Sample

.systemd/auto

Resource

debian9-mipsel-20240611-en

defense_evasion discovery execution persistence privilege_escalatio

debian-9-mipsel

4 signatures

150 seconds

Behavioral task

behavioral11

Sample

.systemd/clean

Resource

ubuntu1804-amd64-20240611-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

.systemd/clean

Resource

debian9-armhf-20240418-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

.systemd/clean

Resource

debian9-mipsbe-20240611-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

.systemd/clean

Resource

debian9-mipsel-20240611-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

.systemd/go

Resource

ubuntu1804-amd64-20240729-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

.systemd/go

Resource

debian9-armhf-20240611-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

.systemd/go

Resource

debian9-mipsbe-20240729-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

.systemd/go

Resource

debian9-mipsel-20240418-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

.systemd/ntpdate

Resource

ubuntu1804-amd64-20240611-en

defense_evasion discovery execution persistence privilege_escalatio upx

ubuntu-18.04-amd64

8 signatures

150 seconds

Behavioral task

behavioral20

Sample

.systemd/ntpdate

Resource

debian9-armhf-20240611-en

defense_evasion discovery execution persistence privilege_escalatio

debian-9-armhf

7 signatures

150 seconds

Behavioral task

behavioral21

Sample

.systemd/ntpdate

Resource

debian9-mipsbe-20240611-en

defense_evasion discovery execution persistence privilege_escalatio

debian-9-mips

8 signatures

150 seconds

Behavioral task

behavioral22

Sample

.systemd/ntpdate

Resource

debian9-mipsel-20240418-en

defense_evasion discovery execution persistence privilege_escalatio

debian-9-mipsel

8 signatures

150 seconds

Behavioral task

behavioral23

Sample

.update/.i686

Resource

ubuntu2004-amd64-20240611-en

antivm discovery execution persistence privilege_escalatio

ubuntu-20.04-amd64

11 signatures

150 seconds

Behavioral task

behavioral24

Sample

.update/.run

Resource

ubuntu1804-amd64-20240611-en

ubuntu-18.04-amd64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

.update/.run

Resource

debian9-armhf-20240729-en

debian-9-armhf

1 signatures

150 seconds

Behavioral task

behavioral26

Sample

.update/.run

Resource

debian9-mipsbe-20240729-en

debian-9-mips

1 signatures

150 seconds

Behavioral task

behavioral27

Sample

.update/.run

Resource

debian9-mipsel-20240611-en

debian-9-mipsel

1 signatures

150 seconds

Behavioral task

behavioral28

Sample

.update/.x86_64

Resource

ubuntu2204-amd64-20240611-en

xmrig antivm discovery execution miner persistence privilege_escalatio

ubuntu-22.04-amd64

14 signatures

150 seconds

Behavioral task

behavioral29

Sample

.update/auth

Resource

ubuntu1804-amd64-20240508-en

discovery persistence privilege_escalation

ubuntu-18.04-amd64

3 signatures

150 seconds

Behavioral task

behavioral30

Sample

.update/auth

Resource

debian9-armhf-20240611-en

discovery persistence privilege_escalation

debian-9-armhf

3 signatures

150 seconds

Behavioral task

behavioral31

Sample

.update/auth

Resource

debian9-mipsbe-20240611-en

discovery persistence privilege_escalation

debian-9-mips

3 signatures

150 seconds

Behavioral task

behavioral32

Sample

.update/auth

Resource

debian9-mipsel-20240729-en

discovery persistence privilege_escalation

debian-9-mipsel

3 signatures

150 seconds

Report Analysis Logs

General

Target

.systemd/.i686
Size

174KB
MD5

ffadb993181c0a9dbb715df2b9c2a5e0
SHA1

04719b1ba0f9df8a131b7271099a813b41611992
SHA256

310352d93eca9c4800c6a11552c0d976b17f5e1cfbcfcbd4c79fbc5bca7a0c61
SHA512

ecc22e8d4b0f2df0a47306b096fdae7e61c3a161d581f14a61e30ecc6d33a621a8fdf42a96359fdf141a8b921345a1695ec37303abafe59280c82f69fd676535
SSDEEP

3072:QHN302U/EaT2zu9s7SlGShG0NnqrKmaJiUZQYHhCsVkbk6ucxmtC8:QHNPU/EaKa9sGrG0dqpsiU6YHhCs0Zu/

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
discovery

Processes:

.i686

description ioc process

File opened for reading /proc/self/exe .i686
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

.i686

description ioc process

File opened for modification /tmp/.ssh .i686

description	ioc	process
File opened for reading	/proc/self/exe	.i686

description	ioc	process
File opened for modification	/tmp/.ssh	.i686

Processes

/tmp/.systemd/.i686
/tmp/.systemd/.i686
1⤵
- Reads runtime system information
- Writes file to tmp directory
PID:1591

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads