Overview

overview

7

Static

static

1

cve_2024_6387/386

ubuntu-24.04-amd64

7

cve_2024_6387/aarch64

ubuntu-22.04-amd64

7

cve_2024_6387/amd64

ubuntu-22.04-amd64

7

cve_2024_6387/arm5

debian-9-armhf

7

cve_2024_6387/arm6

debian-9-armhf

7

cve_2024_6387/arm7

debian-9-armhf

7

cve_2024_6...nup.sh

ubuntu-18.04-amd64

7

cve_2024_6...nup.sh

debian-9-armhf

7

cve_2024_6...nup.sh

debian-9-mips

7

cve_2024_6...nup.sh

debian-9-mipsel

7

cve_2024_6387/exploit

ubuntu-22.04-amd64

7

cve_2024_6...oit.py

windows7-x64

3

cve_2024_6...oit.py

windows10-2004-x64

3

cve_2024_6387/mips

debian-9-mips

3

cve_2024_6387/mips64

debian-9-mips

cve_2024_6...ps64el

debian-9-mipsel

cve_2024_6387/mipsel

debian-12-mipsel

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240729-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    23-11-2024 18:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cve_2024_6387/amd64

  • Size

    5.1MB

  • MD5

    2be087e54204a6c395e05516c53fd579

  • SHA1

    3bdad143cd168a2015aba2053e53f99a24d52ace

  • SHA256

    b60ad90687871ae94e2b33cf2320f523ee614893215335dc5958a6a705488330

  • SHA512

    2ab629a5f9637c7026069e5cc7b473968290b8eb42158dc93c46613d2b4b0ef39149f158b71dda8b2c8bbbebd58ba28cf5437fc0d083fca37deb84423a769db8

  • SSDEEP

    49152:YB9Em2vjYVfh5jw9aF8k4yHwXrD3LwJKiCb85E6l9HblTLEGdvIRKnuI:QDVf/Y4jMrDr8E+rvuK1

Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies environment variables 1 TTPs 3 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Modifies init.d 2 TTPs 34 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies Bash startup script 2 TTPs 3 IoCs
    persistence
  • Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 6 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/cve_2024_6387/amd64
    /tmp/cve_2024_6387/amd64
    1⤵
    • Enumerates kernel/hardware configuration
    PID:1562
    • /tmp/cve_2024_6387/amd64
      /tmp/cve_2024_6387/amd64 " "
      2⤵
      • Modifies Watchdog functionality
      • Creates/modifies environment variables
      • Modifies init.d
      • Modifies Bash startup script
      • Enumerates kernel/hardware configuration
      PID:1566
      • /usr/sbin/update-rc.d
        update-rc.d dns-udp4 defaults
        3⤵
          PID:1576
          • /usr/local/sbin/systemctl
            systemctl daemon-reload
            4⤵
              PID:1577
            • /usr/local/bin/systemctl
              systemctl daemon-reload
              4⤵
                PID:1577
              • /usr/sbin/systemctl
                systemctl daemon-reload
                4⤵
                  PID:1577
                • /usr/bin/systemctl
                  systemctl daemon-reload
                  4⤵
                  • Reads runtime system information
                  PID:1577
              • /usr/bin/mount
                mount -o bind /tmp/ /proc/1566
                3⤵
                • Reads runtime system information
                PID:1614
              • /usr/sbin/service
                service cron start
                3⤵
                  PID:1616
                  • /usr/bin/basename
                    basename /usr/sbin/service
                    4⤵
                      PID:1617
                    • /usr/bin/basename
                      basename /usr/sbin/service
                      4⤵
                        PID:1618
                      • /usr/bin/sed
                        sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                        4⤵
                        • Reads runtime system information
                        PID:1621
                      • /usr/bin/systemctl
                        systemctl list-unit-files --full "--type=socket"
                        4⤵
                        • Reads runtime system information
                        PID:1620
                    • /usr/local/sbin/systemctl
                      systemctl start cron.service
                      3⤵
                        PID:1616
                      • /usr/local/bin/systemctl
                        systemctl start cron.service
                        3⤵
                          PID:1616
                        • /usr/sbin/systemctl
                          systemctl start cron.service
                          3⤵
                            PID:1616
                          • /usr/bin/systemctl
                            systemctl start cron.service
                            3⤵
                            • Reads runtime system information
                            PID:1616
                          • /usr/bin/systemctl
                            systemctl start crond.service
                            3⤵
                            • Reads runtime system information
                            PID:1622

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Persistence

                      Boot or Logon Autostart Execution

                      2
                      T1547

                      Boot or Logon Initialization Scripts

                      1
                      T1037

                      RC Scripts

                      1
                      T1037.004

                      Event Triggered Execution

                      1
                      T1546

                      Unix Shell Configuration Modification

                      1
                      T1546.004

                      Hijack Execution Flow

                      1
                      T1574

                      Path Interception by PATH Environment Variable

                      1
                      T1574.007

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      2
                      T1547

                      Boot or Logon Initialization Scripts

                      1
                      T1037

                      RC Scripts

                      1
                      T1037.004

                      Event Triggered Execution

                      1
                      T1546

                      Unix Shell Configuration Modification

                      1
                      T1546.004

                      Hijack Execution Flow

                      1
                      T1574

                      Path Interception by PATH Environment Variable

                      1
                      T1574.007

                      Defense Evasion

                      Hijack Execution Flow

                      1
                      T1574

                      Path Interception by PATH Environment Variable

                      1
                      T1574.007

                      Impair Defenses

                      1
                      T1562

                      Credential Access

                      Discovery

                      System Information Discovery

                      1
                      T1082

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • /.mod
                        Filesize

                        27B

                        MD5

                        f449ef47c4f79ab4ecfe3d11022333d5

                        SHA1

                        61ebb524cee5a049cc96bf2cbf339a47dcb1b622

                        SHA256

                        503dffa20530956c5f61187e00935f20fe508c35dbb1fcf665b5d28d07d3d704

                        SHA512

                        a7015de8bd582dbf7ce6df708a58a725e1b1cd472c6616fbb89a9738c533c042ac39c071ca0cf2fc5df8e56f33bf8a28b1ebd3076570f5028cff773af89031f6

                        Download Submit

                      • /boot/system.pub
                        Filesize

                        5.1MB

                        MD5

                        2be087e54204a6c395e05516c53fd579

                        SHA1

                        3bdad143cd168a2015aba2053e53f99a24d52ace

                        SHA256

                        b60ad90687871ae94e2b33cf2320f523ee614893215335dc5958a6a705488330

                        SHA512

                        2ab629a5f9637c7026069e5cc7b473968290b8eb42158dc93c46613d2b4b0ef39149f158b71dda8b2c8bbbebd58ba28cf5437fc0d083fca37deb84423a769db8

                        Download Submit

                      • /etc/.cfg
                        Filesize

                        57B

                        MD5

                        25bfc97b9241077f7ee65c9d5831c0ae

                        SHA1

                        4d1e84cfe6f0619642400cbcc77ee008d452f622

                        SHA256

                        7e18da2137e9453fd98ed61aa79420a173383b2f7a5fe6538b70fbb560f9b3f6

                        SHA512

                        e3686c1fe664e67fc503275c6c0fa831ee43c1b081d8f826a616314505e3f952f98a8697911d1799e3f8c1957cd3a1bb5f888766877e5081b32942a6f2d8bff3

                        Download Submit

                      • /etc/.cfg
                        Filesize

                        114B

                        MD5

                        92071bcc0922bd1061693f6ed0aa38e7

                        SHA1

                        d3ae46ee9d53db95102a99a4fe0875472e84b47c

                        SHA256

                        4ecaef901cf8ede372b908b1bff1b814d2eefedc968c50fb33b460ccd02d4829

                        SHA512

                        423e22a53824cef69dfc701655f2479f7af692a8df1eb3c1120f643d872dfc0f0b4377ab8be81d1eb373cef59258dde20fa6f3c50579c82c1deebf9e79fe1ea5

                        Download Submit

                      • /etc/init.d/dns-udp4
                        Filesize

                        159B

                        MD5

                        79f1a0bf1a838c817142e43a5818733a

                        SHA1

                        768ed04a737dbdc969165092694e0e977321ca19

                        SHA256

                        a3f7d4499b03a14ff2de76122b6a61c221151f59daa6a63a78ae5a805c95a482

                        SHA512

                        b6d6f76f3e5b768a6670e05276724b70609259c856ba90ad34f8a782ac40134b9cf5cdabebb4aa55f076a786cedf8491adda9835f9d4aee90bd1820a45b2fbce

                        Download Submit

                      • /etc/profile.d/gateway.sh
                        Filesize

                        4KB

                        MD5

                        4112c36725ae465f31485ef9fa0d132d

                        SHA1

                        9eafc2693ebbf829390bc5f53639cb253eae9e9e

                        SHA256

                        f530cd599d2505c40f29bd284ce61bc7227f0579ff88160ab72a00a3ddfe0f21

                        SHA512

                        dcb6f4a6d592d0f8f766e39dfa5bc5b8eb52a1924c5287ed64a5fefeca344cbb4c48a596e1335b30757d30918c90d439ad453c22b62216953f44349c153a348b

                        Download Submit