Analysis
-
max time kernel
148s -
max time network
131s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240729-en -
resource tags
-
submitted
21-11-2024 12:22
General
-
Target
CHINA-APT-Trojan/home/www/.Xl1/udevd
-
Size
3.4MB
-
MD5
1418fe9a743226b9661a2b6decb19db0
-
SHA1
0ab53321bb9699d354a032259423175c08fec1a4
-
SHA256
ccf8e4d6e661ceaea598851923bb8b983bd820ffd02448b8245e6ac780977784
-
SHA512
548cedaa7e100ca49800878a164989fabe101c58d3dea316efe13b368b18e00899664167b533c3556d6e82697677529cbd1e73cdd87aacac87c12363322042a4
-
SSDEEP
98304:UdgXuBCAPGHGXqiCz6eH+USFUFJYX25Ot:OPmhSWYL
Malware Config
Signatures
-
Write file to user bin folder 3 IoCs
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to shm directory 2 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
Processes
-
/tmp/CHINA-APT-Trojan/home/www/.Xl1/udevd/tmp/CHINA-APT-Trojan/home/www/.Xl1/udevd1⤵
- Write file to user bin folder
- Reads runtime system information
- Writes file to shm directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32B
MD5fd8ebcfae4c6b0f76ae44176d5a08480
SHA10d520752af1739fb60832987aa02a025d1621b59
SHA256c8387bf8dbadf1c9ba583a8d27b620f4bd13cee4ea2ef98bcb0e1bdfd6f3d8c8
SHA512ddc3f4f30ee927a232084df67f92bf08ddeea12b4089f0662dcff27e66f07a19d15f453466731689bc1f6d22e4d0aa2364b60bbab7adb2bb7668935a2da0be75
-
Filesize
1KB
MD5d94245b59537d7615745d53063088b99
SHA1226b93dbddd627648329fead55fb08ea72eb282e
SHA256ea4e54d4226d43215b7b7e33da6a2b50e7967e33d077846e0a3dc3c376b364b0
SHA5123335489ba636c6e81ca54b850f67fe6ef9b88ab4f091a30fe1bf9b5512a6e40d043c528a39e322443609bc5e0f4b528d8b916570b79584490a65cee3c52da1b9
-
Filesize
1KB
MD552735a7d376596697966ef931b58d610
SHA172899537507bfa4684f69b13cd8b6d52015dd115
SHA2566737b8a150bdebf5bb4648eee31eb8146e2f15347418f3ff5036725ea5f3fe87
SHA51264d3dbc2e42e2a8a6b937fa60c7d6f9e858be0dbbbf1deb24d2fc017a558d351e50216741247ccbc67a7a128214c443a6dd0a0b7ad0c7af423f5efa43896f3ac
-
Filesize
1KB
MD5bcfd4f51ace637523dffdb11123277b2
SHA19b343d7a487d7b463b6fe6d449406cc27b6a794d
SHA25627f93214994b8fba058bed5013debb720a2a62d83ddb82e128ce322b5bc976c0
SHA512374614c8bcbfde5e99829d3a7ce509bb6252f0788ef8bd23da1b382e7beead8c4d18d67a928428a0f16830b08f4a348d9dbbb81f7be948d2c21fb121c8ccc4fa
-
Filesize
1KB
MD52dd077239b4c839bc116cebf920d51c0
SHA156a3f8f5264b7548dbe9ece2bce8f45590c34fa8
SHA256fa8328667ffaf6c99fbf8149acb5a6f4617a9cdad39c08505a8fae0edc2ed18a
SHA512b6959f1d82c34f2e45ffd90e03532bc182d6231b075c5c27c4014ae2326124759f0b62b4eafb88f8b3f44e3f46e62961effd302dc7001ec2c9953a55fba10978
-
Filesize
1KB
MD5f254d4354834923858047658b62abc9c
SHA10aadfc4b05168fb1d1c3add0e4198e04fbaa9127
SHA2568fe52655ff6c7790298554090aea624a8830e4f430b5859c7f24523f3b118a72
SHA512958a43ea7f9d5ce2a8e5e202c7e6e1788057210e4b36b40a99116d6b3d0708337040ced4d1f56548c6c19eea385a16ccb233e3d176771a2e4d29ca5e1d5ef104
-
Filesize
3.3MB
MD506ccc4c875bfeca01132b415ec0f4391
SHA13f2dd2ac795396b29645584843e5a46f4cf9de02
SHA256cf20b5a462cb8a85765b0653b83e47c8898f848dffc1d0b39cddeaf7c0d040cc
SHA512462215e0d99a9d8c4debc68cc8f84cba488ce26ababffaa1ffe9cf756c715979161b90f2e3e46c3dfb173d3a2fa7bfd4b2671fd6576ac7cb0011ccb587da0d59
-
Filesize
4B
MD5083e90a484ee81fea834b667eb997c1c
SHA1ffd9e818631ed3d9f46125f27898f64b7dfb15b0
SHA25609a5737b5c1aeeba057d88a00e8a43f32b63bedb4ebe39185d5066c6eff26a44
SHA512a17f4bf17ce22539856cc65e9ea64e6813826bacab120746119d97aa7d16cfc51d91273ccbccf61e2e0c739525a21dce3e2dfee07e049e539a870e8e3f38d319