c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099

Resubmissions

02-01-2025 21:33

250102-1ejbvswpcv 10

08-12-2024 01:12

241208-bkq68azkep 10

Analysis

max time kernel
0s
max time network
132s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
08-12-2024 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Killbash.x
Size

338KB
MD5

7622b6a703b61b767a8f15fe24801ff8
SHA1

d987be4df6349f1ed7934b4e0154ce743bce863d
SHA256

95fb9e93efec22c8426f3d557a0c353ff63aa323f42180ecacdf9cd7cfe4c5aa
SHA512

e950f0eb8b971980342f889b36b2794b883925879e6a8105c1179e9b99492006f324f0aeedc62f77ed7ca8a0cf13c99eb7b6a2e38f4e6bd41e511ac38143fa00
SSDEEP

6144:wFE15RyBAwujPOjS7624nLqFLof5cAw+l0qbRQ2Aj4qewO3TjC45:jllGSWlnLIoRcAw+lFbSsve45

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed

/tmp/Killbash.x
/tmp/Killbash.x
1⤵
PID:2825

/bin/sh
/tmp/Killbash.x -c "exec '/tmp/Killbash.x' \"\$@\"" /tmp/Killbash.x
1⤵
PID:2825

/tmp/Killbash.x
/tmp/Killbash.x
1⤵
PID:2825

/bin/sh
/tmp/Killbash.x -c " #!/bin/sh Config=\"/etc/init.d/Me8ing.conf\" tempfile=`cat \$Config | awk '{print \$1}'` filetemp=\"/usr/bin/\$tempfile\" filename=`date +%s%N | md5sum | head -c 10` filepath=\"/usr/bin/\$filename\" tempbash=`cat \$Config | awk '{print \$2}'` bashtemp=\"/usr/bin/\$tempbash\" bashname=`date +%s%N | md5sum | head -c 10` bashpath=\"/usr/bin/\$bashname\" lockr -i \$bashtemp;rm -f \$bashtemp;killall \$tempbash;pkill \$tempbash lockr -i \$filetemp;rm -f \$filetemp;killall \$tempfile;pkill \$tempfile lockr -i /etc/rc.local;sed -i \"s|\$bashtemp start||\" /etc/rc.local rm -f \$0 exit" /tmp/Killbash.x
1⤵
PID:2825
- /usr/bin/cat
  cat /etc/init.d/Me8ing.conf
  2⤵
  PID:2828
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  - Reads runtime system information
  PID:2829
- /usr/bin/date
  date "+%s%N"
  2⤵
  PID:2831
- /usr/bin/md5sum
  md5sum
  2⤵
  PID:2832
- /usr/bin/head
  head -c 10
  2⤵
  PID:2833
- /usr/bin/cat
  cat /etc/init.d/Me8ing.conf
  2⤵
  PID:2835
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  - Reads runtime system information
  PID:2836
- /usr/bin/date
  date "+%s%N"
  2⤵
  PID:2838
- /usr/bin/md5sum
  md5sum
  2⤵
  PID:2839
- /usr/bin/head
  head -c 10
  2⤵
  PID:2840
- /usr/bin/rm
  rm -f /usr/bin/
  2⤵
  PID:2841
- /usr/bin/killall
  killall
  2⤵
  PID:2842
- /usr/bin/pkill
  pkill
  2⤵
  PID:2843
- /usr/bin/rm
  rm -f /usr/bin/
  2⤵
  PID:2844
- /usr/bin/killall
  killall
  2⤵
  PID:2845
- /usr/bin/pkill
  pkill
  2⤵
  PID:2846
- /usr/bin/sed
  sed -i "s|/usr/bin/ start||" /etc/rc.local
  2⤵
  - Reads runtime system information
  PID:2847
- /usr/bin/rm
  rm -f /tmp/Killbash.x
  2⤵
  PID:2848

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads