Analysis

  • max time kernel
    149s
  • max time network
    134s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240522.1-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    09/11/2024, 23:15

General

  • Target
    Your.Only.Move.is.HUSTLE.v1.9.19/Your.Only.Move.is.HUSTLE.v1.9.19/YourOnlyMoveIsHUSTLE.x86_64
  • Size 48.8MB
  • Sample241109-28jedsvalh
  • SHA256 3b49814e900240f15d5c6cffa8cff4f0295db3574366ec9c63d8a980d2900562
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10

Malware Config

Signatures

  • Reads hardware input events 1 TTPs 4 IoCs

    Reads raw input events from the evdev driver, possibly to record keystrokes.

  • Changes its process name 5 IoCs
  • Reads CPU attributes 1 TTPs 1 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 15 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/Your.Only.Move.is.HUSTLE.v1.9.19/Your.Only.Move.is.HUSTLE.v1.9.19/YourOnlyMoveIsHUSTLE.x86_64
    /tmp/Your.Only.Move.is.HUSTLE.v1.9.19/Your.Only.Move.is.HUSTLE.v1.9.19/YourOnlyMoveIsHUSTLE.x86_64
    1⤵
    • Reads hardware input events
    • Changes its process name
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Writes file to tmp directory
    PID:1566

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        5cd998ba62161e10a709977d622797320003f9.tmp

        • Path /root/.cache/mesa_shader_cache/08/5cd998ba62161e10a709977d622797320003f9.tmp
        • Size 2KB
        • SHA256 5fdc69dccd975ddd906cf3b6ff3770d0b5ca8263bb38d94933db2649c07d880f
        • MD5 SHA1 SHA512

        8ea8d489f24b7637fee49f5d4948caf0bd2889.tmp

        • Path /root/.cache/mesa_shader_cache/0e/8ea8d489f24b7637fee49f5d4948caf0bd2889.tmp
        • Size 4KB
        • SHA256 28935059373fec332e02b68e0bedf13ccfc1dbca8ba4922e89c19bbcf83fb8b4
        • MD5 SHA1 SHA512 SSDEEP

        28b8958e47848afc3aa580fe846ab073f2e664.tmp

        • Path /root/.cache/mesa_shader_cache/14/28b8958e47848afc3aa580fe846ab073f2e664.tmp
        • Size 3KB
        • SHA256 a989f6bb0e6345960d146a0818353e6cde456bc100bb5ee13d5f1aba499ae1f6
        • MD5 SHA1 SHA512

        93c7e1618d8d44dfb317aa2fcbfbb09421ad56.tmp

        • Path /root/.cache/mesa_shader_cache/37/93c7e1618d8d44dfb317aa2fcbfbb09421ad56.tmp
        • Size 2KB
        • SHA256 6ce179bbc0b1d243591ca2844a3ea693b83a83a061766ae9a93d071bc67696bd
        • MD5 SHA1 SHA512

        54b7c073f201af60b61f62fc8157c4b5b05f10.tmp

        • Path /root/.cache/mesa_shader_cache/50/54b7c073f201af60b61f62fc8157c4b5b05f10.tmp
        • Size 3KB
        • SHA256 d37bb6df13583da9aab70abf7bd558ae82765e60d230c7711c942ba446c913fd
        • MD5 SHA1 SHA512

        b1e1b35399479ca97a111484b2488211381018.tmp

        • Path /root/.cache/mesa_shader_cache/67/b1e1b35399479ca97a111484b2488211381018.tmp
        • Size 3KB
        • SHA256 e8dda62eef03a448c0687a3122676e85b93703122d66cb0eca1bdf2dbaea9706
        • MD5 SHA1 SHA512

        babcc1e17eb91c1392a5bac0526008c97d4b3d.tmp

        • Path /root/.cache/mesa_shader_cache/68/babcc1e17eb91c1392a5bac0526008c97d4b3d.tmp
        • Size 2KB
        • SHA256 06413ada35b640798672da7e43d024d55d817937bda9424a8d4cef5eb446b893
        • MD5 SHA1 SHA512

        523f564b34aff5b414b460b65ad0d5c2a0ba1b.tmp

        • Path /root/.cache/mesa_shader_cache/6e/523f564b34aff5b414b460b65ad0d5c2a0ba1b.tmp
        • Size 2KB
        • SHA256 69e8765f12ec1f54ab80b47dca902c76d215617de20ee7c09a53ec443aa94fff
        • MD5 SHA1 SHA512

        c33c479f2be0db5d9f093b3153a141d904bad2.tmp

        • Path /root/.cache/mesa_shader_cache/93/c33c479f2be0db5d9f093b3153a141d904bad2.tmp
        • Size 3KB
        • SHA256 0da34ce0a6ac70e53dc858024dac22e738018206c730fba1f4964b457fa526da
        • MD5 SHA1 SHA512

        847fce70f1c5481e2239aa0e49e2bc8eb16873.tmp

        • Path /root/.cache/mesa_shader_cache/bd/847fce70f1c5481e2239aa0e49e2bc8eb16873.tmp
        • Size 3KB
        • SHA256 00937844bb414f0f0256621c12b8304768a92e1a7f19001dd5757c99c252ecf5
        • MD5 SHA1 SHA512

        890c0abd9bb3a376c9f66cf8aff4c7c3a964fd.tmp

        • Path /root/.cache/mesa_shader_cache/d7/890c0abd9bb3a376c9f66cf8aff4c7c3a964fd.tmp
        • Size 2KB
        • SHA256 1ad04704bf8d92d0711d02df2d561b04cb05fa81c17a5f2e08cf97f3a20ce340
        • MD5 SHA1 SHA512

        c6f8b71c7605f157a780b6b38d888755ffe6de.tmp

        • Path /root/.cache/mesa_shader_cache/ed/c6f8b71c7605f157a780b6b38d888755ffe6de.tmp
        • Size 3KB
        • SHA256 f59e3747e5e62b77abdfd2c5a5d9baf36f4f8e1bd31c53cf156c77929a56eafe
        • MD5 SHA1 SHA512

        bcff3b406f8c2e77e982fcfdc91c28d374b5ef.tmp

        • Path /root/.cache/mesa_shader_cache/f2/bcff3b406f8c2e77e982fcfdc91c28d374b5ef.tmp
        • Size 1KB
        • SHA256 9cae446abeadc8f310c039ab46a71f6d72a1d603261786cd7cebdf238889df8d
        • MD5 SHA1 SHA512

        godot.log

        • Path /tmp/Your.Only.Move.is.HUSTLE.v1.9.19/Your.Only.Move.is.HUSTLE.v1.9.19/YourOnlyMoveIsHUSTLE/logs/godot.log
        • Size 6KB
        • SHA256 88c3f7ce90cc2f925745fa697823c93370498e6989eb986996c94d1b40d83d20
        • MD5 SHA1 SHA512 SSDEEP

        modded.json

        • Path /tmp/Your.Only.Move.is.HUSTLE.v1.9.19/Your.Only.Move.is.HUSTLE.v1.9.19/YourOnlyMoveIsHUSTLE/modded.json
        • Size 25B
        • SHA256 2d7392d1e5f8a1839b6c0e4481ca447636c50a2e40567b73a1d7a37bcc2ae7f7
        • MD5 SHA1 SHA512

        playerdata.json

        • Path /tmp/Your.Only.Move.is.HUSTLE.v1.9.19/Your.Only.Move.is.HUSTLE.v1.9.19/YourOnlyMoveIsHUSTLE/playerdata.json
        • Size 728B
        • SHA256 738e82032dc0313af26931dab3fbb0bfd624dbc5564c26a85dc8b213821bd139
        • MD5 SHA1 SHA512

        playerdata.json

        • Path /tmp/Your.Only.Move.is.HUSTLE.v1.9.19/Your.Only.Move.is.HUSTLE.v1.9.19/YourOnlyMoveIsHUSTLE/playerdata.json
        • Size 728B
        • SHA256 8e80a234c2e86b7128b4a7cc56005a78d740207b59299b73ea6e30f699f5af83
        • MD5 SHA1 SHA512