Overview

overview

10

Static

static

1

20e0e61d27...58.elf

ubuntu-22.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240522.1-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    22/11/2024, 20:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    20e0e61d27762a524f6974fb9f4995062582db351d5576e62a214d6b5e5808e7/20e0e61d27762a524f6974fb9f499506258.elf

  • Size

    1.7MB

  • MD5

    503c35c37d00d04ff2793c2b4bf5038f

  • SHA1

    a03a9d06ca8441cb2ec7fe0c49cb56023130d884

  • SHA256

    20e0e61d27762a524f6974fb9f4995062582db351d5576e62a214d6b5e5808e7

  • SHA512

    c653fd4f8a6724b9a25e24e9a2a0152340be294d4d53d82e5762fd8599b014dabc4be6a2830822d51ce744ef256f1e5fe78b5c016fc24907de7ea964fb5835ee

  • SSDEEP

    24576:94GdIhU6rF5IF0pGVZa4B6dmyw5DQ7EQ6LPni2Mt+aa:XShUL7VZ1BYZw5DcRt+a

Score
10/10
antivmdefense_evasiondiscoverypersistenceprivilege_escalationransomware

Malware Config

Extracted

Path

/usr/sbin/RECOVERY INFO.txt

Ransom Note
Your data has been encrypted In order to return your files back you need decryption tool 1)Download TOR Browser 2)Open in TOR browser link below and contact with us there: http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/C8C93634D8B19BE4FE221FDE41C180431DFB7200F6426B11C5A95B77AF263DB5 Or email: [email protected] Limit for free decryption: 3 files up to 5mb (no database or backups)
URLs

http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/C8C93634D8B19BE4FE221FDE41C180431DFB7200F6426B11C5A95B77AF263DB5

Signatures

  • Renames multiple (107) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Adds new SSH keys 1 TTPs 2 IoCs

    Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

    persistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 4 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes file to system bin folder 64 IoCs
  • Modifies Bash startup script 2 TTPs 4 IoCs
    persistence
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 1 IoCs
    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 64 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/20e0e61d27762a524f6974fb9f4995062582db351d5576e62a214d6b5e5808e7/20e0e61d27762a524f6974fb9f499506258.elf
    /tmp/20e0e61d27762a524f6974fb9f4995062582db351d5576e62a214d6b5e5808e7/20e0e61d27762a524f6974fb9f499506258.elf
    1⤵
    • Adds new SSH keys
    • Creates/modifies environment variables
    • Writes file to system bin folder
    • Modifies Bash startup script
    • Checks CPU configuration
    • Reads CPU attributes
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1551

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

1
T1098

SSH Authorized Keys

1
T1098.004

Boot or Logon Autostart Execution

1
T1547

Event Triggered Execution

1
T1546

Unix Shell Configuration Modification

1
T1546.004

Hijack Execution Flow

1
T1574

Path Interception by PATH Environment Variable

1
T1574.007

Privilege Escalation

Account Manipulation

1
T1098

SSH Authorized Keys

1
T1098.004

Boot or Logon Autostart Execution

1
T1547

Event Triggered Execution

1
T1546

Unix Shell Configuration Modification

1
T1546.004

Hijack Execution Flow

1
T1574

Path Interception by PATH Environment Variable

1
T1574.007

Defense Evasion

Hijack Execution Flow

1
T1574

Path Interception by PATH Environment Variable

1
T1574.007

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Credential Access

Discovery

System Information Discovery

1
T1082

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • /tmp/20e0e61d27762a524f6974fb9f4995062582db351d5576e62a214d6b5e5808e7/sbin_update-grub2
    Filesize

    4B

    MD5

    0afb21a5f243ec6c489ce1033bd2c71d

    SHA1

    62ea23f71d0d21fb2ef63d9de4b871f5b113d051

    SHA256

    5e873c29ac18e151673593f7e7e1a5f72e952ea870b1aa3037740d722c963937

    SHA512

    9c883309aadcdf36be075438dc76bbfb0c2d33bd2466d11a34a6cad0b9eb7542baac6ef46bf9431b9588facbea024928f3fcda2acef098fbf62c26c153f04f1b

    Download Submit

  • /tmp/20e0e61d27762a524f6974fb9f4995062582db351d5576e62a214d6b5e5808e7/stepdata.txt
    Filesize

    471B

    MD5

    5c64ba37d0cd7f572795118195091dbf

    SHA1

    27aabdaf647ff1bdc0f16eedc4b9de7bae0a6e4b

    SHA256

    789c2df5f265b70e7ae41f3ea3d32ec8c7acf213b0935b61701dd69d6c9e3ace

    SHA512

    c0bd1abb0df9754a15b30ec1d249a291c973e63b828ec02b92fdfd226729f63790fd27c06b536a55bae37b8db7bcbe6dc21d990762ef3b9647f09c197c285596

    Download Submit

  • /usr/sbin/RECOVERY INFO.txt
    Filesize

    441B

    MD5

    d9f75854b57665455bed233f93d774c1

    SHA1

    d7d1c646e7f822be2148650adc20c767d75db930

    SHA256

    bdd9158f38b73ee522765b036c63ef252d4ba60c059ad00fa728488bb0c8d83e

    SHA512

    61ccfd1fb7e10b54ed48cd8adaf07597fceebc1a0506a48b6c9fe0c951b3a48d45d739fea9c4fdcd0c5d6e27384faed5d319476b3a4f38a7288e11c5f4946b94

    Download Submit