3231a0ef57c7107fefb310e12f4d2994fc9d0afd9c76148ce1cd409d5cb5dd7e

Analysis

max time kernel
0s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240522.1-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
15-12-2024 04:14

Sharing

Copy URL

Twitter E-mail

Reason

Payload did not run: exit status 2

Report Analysis Logs

General

Target

rebirth.x86.elf
Size

75KB
MD5

c70d6d70685235b94fed5ec73aed3b2c
SHA1

cc9ebae95a7c15a670388fc44e0fd41547c17e18
SHA256

3231a0ef57c7107fefb310e12f4d2994fc9d0afd9c76148ce1cd409d5cb5dd7e
SHA512

e3fb2b71ad3a106724355eeae05f20f483ebd5c78e36d93c2a2ad7137bb6fd95b3c79d916322a99b2819c07ee00bc132cf1bad1735edc3a02e4144dd5c408954
SSDEEP

1536:dvBGpSzKkubpUa2jecqCR/JYHqDIw+e6+MFOPRkTZRbXXTzpwbZnR+5:hcpHblUaBcPNeHqEw36FOPOZRTXTNwbf

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1567	sh

/tmp/rebirth.x86.elf
/tmp/rebirth.x86.elf
1⤵
PID:1566
- /bin/sh
  sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/rebirth.x86.elf bin/systemd; chmod 777 bin/systemd"
  2⤵
  - File and Directory Permissions Modification
  PID:1567
- - /usr/bin/rm
    rm -rf bin/systemd
    3⤵
    PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads