Analysis
-
max time kernel
1s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
-
submitted
08-11-2024 11:36
General
-
Target
.systemd/auto
-
Size
546B
-
MD5
e587a0a58aaac49aeb3bf0eff743eab2
-
SHA1
636b68d9e02328e5d68880e22fdf73f6e0df4a66
-
SHA256
7c7fef23a91fb19f98f584f545a27f58bdf7eda4f57bd80d173825413ac6662d
-
SHA512
4168c61744633ded40261c99cb06ddb07fea4bd6fbff6bfacabd1668166a86ba7f344b5d20c2933877860f204373b1560cdf398a25d1770c8b3a0f28146b7da9
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/.systemd/auto/tmp/.systemd/auto1⤵
- Writes file to tmp directory
-
/bin/unameuname -m2⤵
-
-
/bin/catcat systemd.dir2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
- Reads runtime system information
-
-
/bin/grepgrep .systemd2⤵
-
-
/usr/bin/wcwc -l2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
- Reads runtime system information
-
-
/usr/bin/crontabcrontab systemd.d2⤵
- Creates/modifies Cron job
- Reads runtime system information
-
-
/bin/rmrm -rf systemd.d2⤵
-
-
/bin/chmodchmod u+x .systemd2⤵
- File and Directory Permissions Modification
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD520abc8e72d4066c0565f7bbfad0fe526
SHA110cb464b8e9401cb3bfe17e059c957d79f4a93dd
SHA256579de93e6119bdd4eb948bbdc32b0a3340bab93d4d0b5db723dbc5dddf82b09b
SHA5129d849197900f20993624e5b713b24c72ffd269b078a7fc8574211258899bc70ddc85f00259d5f6aa3b032bcc0ec687524f042b6fed5e4fa96781d03a858ac977
-
Filesize
14B
MD51f3a48ead214b69a4e5bbcc12a732ddb
SHA13391a93f27a805c58de438e5a50267af13b619ab
SHA2568ebe6ec5aee16e2d6ea3fe45a22e72ad8f936a83a7fc9e82591885bcb45e322c
SHA512386b19da83f4b8416d17960a3c0832b38521a3396dbf99501dcf03811e17d1696b18db4131f66375889afc2c44d791dd62239a86d3ba0fa614b8547480a7381d
-
Filesize
216B
MD5dbb47228523c48edfe60dda1b012f03d
SHA164adf38fbd662f2cdc856b0a1a1898d60d2e5c14
SHA2560985d86b6a0b52111095135d4a0e5405848d42318445492d6540784bfc61f30e
SHA512a720fc83063c925b735443be41ae8857d342c1a6dd64afe3463b6c9c64c35e4725641d3db5dd5ce7f22fc965e77d5218fb0903c592c51c777992e59b9419a287