0de9266af49aab24256c289d39e86649d978d5a4c9d0ff2041a22140b88ea688

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
08-11-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.systemd/auto
Size

546B
MD5

e587a0a58aaac49aeb3bf0eff743eab2
SHA1

636b68d9e02328e5d68880e22fdf73f6e0df4a66
SHA256

7c7fef23a91fb19f98f584f545a27f58bdf7eda4f57bd80d173825413ac6662d
SHA512

4168c61744633ded40261c99cb06ddb07fea4bd6fbff6bfacabd1668166a86ba7f344b5d20c2933877860f204373b1560cdf398a25d1770c8b3a0f28146b7da9

Score

7^/10

defense_evasion execution persistence privilege_escalatio

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

Processes:

chmod

pid	Process
1518	chmod

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

Processes:

crontab

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.V7hfn5	crontab

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

Processes:

auto

description	ioc	Process
File opened for modification	/tmp/.systemd/systemd.dir	auto
File opened for modification	/tmp/.systemd/systemd.d	auto
File opened for modification	/tmp/.systemd/.systemd	auto

/tmp/.systemd/auto
/tmp/.systemd/auto
1⤵
- Writes file to tmp directory
PID:1508
- /bin/uname
  uname -m
  2⤵
  PID:1509
- /bin/cat
  cat systemd.dir
  2⤵
  PID:1510
- /usr/bin/wc
  wc -l
  2⤵
  PID:1514
- /bin/grep
  grep .systemd
  2⤵
  PID:1513
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1512
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1515
- /usr/bin/crontab
  crontab systemd.d
  2⤵
  - Creates/modifies Cron job
  PID:1516
- /bin/rm
  rm -rf systemd.d
  2⤵
  PID:1517
- /bin/chmod
  chmod u+x .systemd
  2⤵
  - File and Directory Permissions Modification
  PID:1518

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/.systemd/.systemd

Filesize
129B

MD5
31e12aacb4572270e99f912dfb4e1d2c

SHA1
942830707a5f7de945e4bf6192c2266bfd529018

SHA256
f54b32d1e82e3fa5af6e074fdeb416ac8b8581f2cf5ef357d94c9241815228fd

SHA512
be1d751a060eef9e6c5b4d5df4578b2b38631b813ce8d9f7d84563779a1168ce934dad06d39ff501adf47f219531b7a571accb9a857e716a42cb98057010a5d2

Download Submit
/tmp/.systemd/systemd.dir

Filesize
14B

MD5
1f3a48ead214b69a4e5bbcc12a732ddb

SHA1
3391a93f27a805c58de438e5a50267af13b619ab

SHA256
8ebe6ec5aee16e2d6ea3fe45a22e72ad8f936a83a7fc9e82591885bcb45e322c

SHA512
386b19da83f4b8416d17960a3c0832b38521a3396dbf99501dcf03811e17d1696b18db4131f66375889afc2c44d791dd62239a86d3ba0fa614b8547480a7381d

Download Submit
/var/spool/cron/crontabs/tmp.V7hfn5

Filesize
216B

MD5
c0cf181774a9fad926645284a3680db5

SHA1
af146029c4b74552e4bbcb3d6fac3efe25898394

SHA256
3d96819b05bc634c0a6c10307757c360512c9af8ff898ee2ae9014e20bffc5a5

SHA512
85b7dd7adcfc0b75596b43e5768e06f6e81914b007044286113bc5c26132bffcf2898c912cc492bdad977f1c4d86272fb4fc531fa1ccf5c70cc952721f1cc244

Download Submit