3b15778595cef00d1a51035dd4fd65e6be97e73544cb1899f40aec4aaa0445ae

Analysis

max time kernel
43s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
03-12-2024 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b15778595cef00d1a51035dd4fd65e6be97e73544cb1899f40aec4aaa0445ae
Size

1KB
MD5

51a900215c41691542f83df8cb053ef7
SHA1

efaca58b61cb70b87a075fad593c81beb757ad7e
SHA256

3b15778595cef00d1a51035dd4fd65e6be97e73544cb1899f40aec4aaa0445ae
SHA512

15ff74bcc1f503f31cc8bff6fad446a1f5a7c774b13c623071ceb480bddef28d7a942f1e15b68a98eaa6e481a581c6792b734075011bd96a34fcbf0e256aa5b1

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
761	chmod
766	chmod
772	chmod
756	chmod

Executes dropped EXE 4 IoCs

ioc	pid	Process
/.redtail	757	.redtail
/.redtail	763	.redtail
/.redtail	768	.redtail
/.redtail	773	.redtail

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/mounts	cat
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	cp

/tmp/3b15778595cef00d1a51035dd4fd65e6be97e73544cb1899f40aec4aaa0445ae
/tmp/3b15778595cef00d1a51035dd4fd65e6be97e73544cb1899f40aec4aaa0445ae
1⤵
PID:690
- /bin/uname
  uname -mp
  2⤵
  PID:692
- /bin/grep
  grep -q x86_64
  2⤵
  PID:699
- /bin/grep
  grep -q amd64
  2⤵
  PID:703
- /bin/grep
  grep -q "i[3456]86"
  2⤵
  PID:706
- /bin/grep
  grep -q armv8
  2⤵
  PID:709
- /bin/grep
  grep -q aarch64
  2⤵
  PID:713
- /bin/grep
  grep -q armv7
  2⤵
  PID:716
- /bin/cat
  cat /proc/mounts
  2⤵
  - Reads runtime system information
  PID:721
- /bin/grep
  grep noexec
  2⤵
  PID:722
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  - Reads runtime system information
  PID:723
- /usr/bin/whoami
  whoami
  2⤵
  PID:729
- /usr/bin/find
  find / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*"
  2⤵
  - Reads runtime system information
  PID:730
- /usr/bin/touch
  touch .testfile
  2⤵
  PID:746
- /bin/dd
  dd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"
  2⤵
  PID:749
- /bin/rm
  rm -rf .testfile .testfile2
  2⤵
  PID:750
- /bin/cp
  cp -r "/tmp/redtail.*" /
  2⤵
  - Reads runtime system information
  PID:751
- /bin/rm
  rm -rf .redtail
  2⤵
  PID:753
- /bin/cat
  cat redtail.x86_64
  2⤵
  PID:755
- /bin/chmod
  chmod +x .redtail
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /.redtail
  ./.redtail ssh
  2⤵
  - Executes dropped EXE
  PID:757
- /bin/cat
  cat redtail.i686
  2⤵
  PID:760
- /bin/chmod
  chmod +x .redtail
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /.redtail
  ./.redtail ssh
  2⤵
  - Executes dropped EXE
  PID:763
- /bin/cat
  cat redtail.arm8
  2⤵
  PID:765
- /bin/chmod
  chmod +x .redtail
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /.redtail
  ./.redtail ssh
  2⤵
  - Executes dropped EXE
  PID:768
- /bin/cat
  cat redtail.arm7
  2⤵
  PID:770
- /bin/chmod
  chmod +x .redtail
  2⤵
  - File and Directory Permissions Modification
  PID:772
- /.redtail
  ./.redtail ssh
  2⤵
  - Executes dropped EXE
  PID:773
- /bin/rm
  rm -rf "redtail.*"
  2⤵
  PID:775
- /bin/rm
  rm -rf "/tmp/redtail.*"
  2⤵
  PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/.testfile2

Filesize
2.0MB

MD5
b2d1236c286a3c0704224fe4105eca49

SHA1
7d76d48d64d7ac5411d714a4bb83f37e3e5b8df6

SHA256
5647f05ec18958947d32874eeb788fa396a05d0bab7c1b71f112ceb7e9b31eee

SHA512
731859029215873fdac1c9f2f8bd25a334abf0f3a9e1b057cf2cacc2826d86b0c26a3fa920a936421401c0471f38857cb53ba905489ea46b185209fdff65b3b6

Download Submit