Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    10-12-2024 17:02

General

  • Target

    rebirth.dbg.elf

  • Size

    73KB

  • MD5

    3b144730f38371b45d921f2ae5523589

  • SHA1

    e91c857f7e377c05b3584ff14a151b074f1a8604

  • SHA256

    2fee0a938d98883e12a66ab95af6e8dbadf8c045a7ebc69dc87e19c56e67b9d5

  • SHA512

    2bd2d4daa187d752d856f72a5975ed888c107eeac2042d23a1beee1133deb546df3029ff042d73b8fafd2a350a5ae086e49295537bd6d1227cf795a7a8f74d13

  • SSDEEP

    1536:Fyjn5NDwpzW4xUxdGt/qqzZmwV7/UXphLpYGBVPY409s0wbZnl:oj5NDOiGUxmhZm67/OhlBVPY4cwbZnl

Malware Config

Signatures

  • Contacts a large (82756) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Changes its process name 1 IoCs
  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/rebirth.dbg.elf
    /tmp/rebirth.dbg.elf
    1⤵
    • Changes its process name
    PID:1589
    • /bin/sh
      sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/rebirth.dbg.elf bin/systemd; chmod 777 bin/systemd"
      2⤵
      • File and Directory Permissions Modification
      • Writes file to tmp directory
      PID:1590
      • /usr/bin/rm
        rm -rf bin/systemd
        3⤵
          PID:1591
        • /usr/bin/mkdir
          mkdir bin
          3⤵
          • Reads runtime system information
          PID:1592
        • /usr/bin/mv
          mv /tmp/rebirth.dbg.elf bin/systemd
          3⤵
          • Reads runtime system information
          PID:1593
        • /usr/bin/chmod
          chmod 777 bin/systemd
          3⤵
          • File and Directory Permissions Modification
          PID:1594

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads