Analysis
-
max time kernel
2s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
-
submitted
08-11-2024 11:36
General
-
Target
.systemd/ntpdate
-
Size
4KB
-
MD5
e1e04a6303387665ef0db838157d63d6
-
SHA1
ebb08e424ce4251827c0ddea5ac91f971a1a8f73
-
SHA256
af0b766bcffc9bf2e2a1a6059515d0bc58e60d4de3fe19598de7411fb619b65d
-
SHA512
f2eea4ac06e9cb750e36a35a10e22cdd60403982f9d1597cd96002972b7fe3228c8ae3caf5f7cc028221a36d81615be4369a9f34fa4c81ae84dd1dd0f5cf4f76
-
SSDEEP
48:QuH1wKQWqaT2WHKBNCNN12WHNS4g2WHEoeXa5J2WH95J2WHT:1V4WH+C4WHNRWHEoeRWHsWHT
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 4 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Attempts to change immutable files 9 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
-
Creates/modifies Cron job 1 TTPs 5 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Modifies init.d 2 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
-
Writes file to system bin folder 2 IoCs
-
Reads runtime system information 5 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/.systemd/ntpdate/tmp/.systemd/ntpdate1⤵
- Writes file to tmp directory
-
/bin/unameuname -m2⤵
-
-
/bin/catcat systemd.dir2⤵
-
-
/bin/mkdirmkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly2⤵
- Reads runtime system information
-
-
/usr/bin/chattrchattr -i -a "/etc/cron.*/ntpdate" /sbin/bcrond2⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf /sbin/bcrond2⤵
-
-
/bin/cpcp -f -r -- /tmp/.systemd/.armv7l /sbin/bcrond2⤵
- Reads runtime system information
-
-
/usr/bin/teetee -a /etc/cron.d/ntpdate /etc/cron.daily/ntpdate /etc/cron.hourly/ntpdate /etc/cron.monthly/ntpdate /etc/cron.weekly/ntpdate2⤵
- Creates/modifies Cron job
-
-
/bin/chmodchmod +x /etc/cron.daily/ntpdate /etc/cron.d/ntpdate /etc/cron.hourly/ntpdate /etc/cron.monthly/ntpdate /etc/cron.weekly/ntpdate /sbin/bcrond2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/chattrchattr +i +a /etc/cron.daily/ntpdate /etc/cron.d/ntpdate /etc/cron.hourly/ntpdate /etc/cron.monthly/ntpdate /etc/cron.weekly/ntpdate /sbin/bcrond2⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -a -i /sbin/bsysd2⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf /sbin/bsysd2⤵
-
-
/usr/bin/whichwhich systemctl2⤵
-
-
/usr/bin/chattrchattr -i -a /sbin/entpdate /sbin/bsysde2⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf /sbin/bsysde2⤵
-
-
/bin/cpcp -f -r -- /tmp/.systemd/.armv7l /sbin/bsysde2⤵
- Reads runtime system information
-
-
/usr/bin/teetee -a /sbin/entpdate2⤵
- Writes file to system bin folder
-
-
/bin/chmodchmod +x /sbin/entpdate2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/chattrchattr +i +a /sbin/entpdate /sbin/bsysde2⤵
- Attempts to change immutable files
-
-
/usr/bin/whichwhich systemctl2⤵
-
-
/usr/bin/chattrchattr -i -a /sbin/lntpdate /sbin/bsysdl2⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf /sbin/bsysdl2⤵
-
-
/bin/cpcp -f -r -- /tmp/.systemd/.armv7l /sbin/bsysdl2⤵
- Reads runtime system information
-
-
/usr/bin/teetee -a /sbin/lntpdate2⤵
- Writes file to system bin folder
-
-
/bin/chmodchmod +x /sbin/lntpdate2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/chattrchattr +i +a /sbin/lntpdate /sbin/bsysdl2⤵
- Attempts to change immutable files
-
-
/usr/bin/whichwhich update-rc.d2⤵
-
-
/usr/bin/chattrchattr -i -a /etc/init.d/ntpdate /sbin/binitd2⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf /sbin/binitd2⤵
-
-
/bin/cpcp -f -r -- /tmp/.systemd/.armv7l /sbin/binitd2⤵
- Reads runtime system information
-
-
/usr/bin/teetee -a /etc/init.d/ntpdate2⤵
- Modifies init.d
-
-
/bin/chmodchmod +x /etc/init.d/ntpdate /sbin/binitd2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/chattrchattr +i +a /etc/init.d/ntpdate /sbin/binitd2⤵
- Attempts to change immutable files
-
-
/usr/bin/whichwhich chkconfig2⤵
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
365B
MD5755700d11d59e0daeb4f6452aee1ad5d
SHA16b1194921376bef9c7559629712772a11e78eaa4
SHA2561b311adac81faa8f9bf687306192ff84c2ee12a9337dd1051c55004ce39a2b00
SHA512446f3d05218fa12190dadd2f405345b9a5581221064314e8bce54b155c08ad9bdba17d15f6959e5eb987baaffa309cfb19bf92a1a944d580f66419060a44b2b7
-
Filesize
365B
MD5bd99a962d94b5b4c32f8b7c8ca1f9ea9
SHA1af33dc04d1f16e5ccceb2c0569b26e45bb65b32b
SHA25664e489965b3914b15f92dadd851560e95287a40923b6cc93849e0758cdbf8b28
SHA512fc2f81575bab833e76f070a45c3b9a1a32bb3c19084166c0beed3d03694d38295f6761af1599169f84a2c6f4b8c8bd8e1d8230796191de84dda52edd6899cdfa
-
Filesize
365B
MD54aeb6335d69473274691f59dc2096cfe
SHA1440755e42aa67c6ab3e636aeb1e8ec9463cd7ffc
SHA25687095fcf498e832162baa13ecd28367155d8a1b5d02aee9ec1b60e149a871785
SHA51223b0ef7f02e090cae5b7c20f8b06f4c450e6e8ddc49f3df9c49d223aa2df36339bb92df56e4609240d5e2066ee328db0abebd38de4b3eef304e83e72f4f1886c
-
Filesize
365B
MD53748e897538baafbc7b260b4d2fbc98f
SHA141d179e3cfc4c1820ea2c0fed0d50009564db79b
SHA256ebcbd097cd86e990591360d56f077f37de35fd6f4ce222c6d286f2f7e1024cc7
SHA51223519c47db8c96ed72be6833778013df9199bb6d243e989fca2a75dd55d2a5aca37228fc19b0e2537cb5e10a27d69815edc5b640c8e878d7e767559904eaccea
-
Filesize
14B
MD51f3a48ead214b69a4e5bbcc12a732ddb
SHA13391a93f27a805c58de438e5a50267af13b619ab
SHA2568ebe6ec5aee16e2d6ea3fe45a22e72ad8f936a83a7fc9e82591885bcb45e322c
SHA512386b19da83f4b8416d17960a3c0832b38521a3396dbf99501dcf03811e17d1696b18db4131f66375889afc2c44d791dd62239a86d3ba0fa614b8547480a7381d