Overview
overview
10Static
static
10329D6F9DDB...I_I386
ubuntu-24.04-amd64
329D6F9DDB...XI_X64
ubuntu-24.04-amd64
8LBB.exe
windows7-x64
9LBB.exe
windows10-2004-x64
9LBB_PS1.ps1
windows7-x64
5LBB_PS1.ps1
windows10-2004-x64
9LBB_PS1_ob...ed.ps1
windows7-x64
3LBB_PS1_ob...ed.ps1
windows10-2004-x64
3LBB_PS1_pass.ps1
windows7-x64
10LBB_PS1_pass.ps1
windows10-2004-x64
10LBB_Reflec...in.dll
windows7-x64
9LBB_Reflec...in.dll
windows10-2004-x64
7LBB_Rundll32.dll
windows7-x64
3LBB_Rundll32.dll
windows10-2004-x64
3LBB_Rundll32_pass.dll
windows7-x64
10LBB_Rundll32_pass.dll
windows10-2004-x64
10LBB_pass.exe
windows7-x64
10LBB_pass.exe
windows10-2004-x64
10FC8E43EC21...32.exe
windows7-x64
7FC8E43EC21...32.exe
windows10-2004-x64
7FC8E43EC21...64.exe
windows7-x64
7FC8E43EC21...64.exe
windows10-2004-x64
71007BF65F8..._ARM64
ubuntu-18.04-amd64
1007BF65F8..._ARM64
debian-9-armhf
1007BF65F8..._ARM64
debian-9-mips
1007BF65F8..._ARM64
debian-9-mipsel
1007BF65F8..._ARMV5
debian-9-armhf
81007BF65F8..._ARMV7
debian-9-armhf
81007BF65F8..._AMD64
ubuntu-24.04-amd64
1007BF65F8...X_I386
ubuntu-22.04-amd64
1007BF65F8...UX_X64
ubuntu-22.04-amd64
81007BF65F8...r_MIPS
debian-9-mips
8Analysis
-
max time kernel
149s -
max time network
130s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
19-12-2024 22:25
Behavioral task
behavioral1
Sample
329D6F9DDBF138D4/locker_ESXI_I386
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral2
Sample
329D6F9DDBF138D4/locker_ESXI_X64
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral3
Sample
LBB.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
LBB.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
LBB_PS1.ps1
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
LBB_PS1.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
LBB_PS1_obfuscated.ps1
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral8
Sample
LBB_PS1_obfuscated.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
LBB_PS1_pass.ps1
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
LBB_PS1_pass.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
LBB_ReflectiveDll_DllMain.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
LBB_ReflectiveDll_DllMain.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
LBB_Rundll32.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral14
Sample
LBB_Rundll32.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
LBB_Rundll32_pass.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
LBB_Rundll32_pass.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
LBB_pass.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral18
Sample
LBB_pass.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
FC8E43EC21BE9047/lbg32.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
FC8E43EC21BE9047/lbg32.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
FC8E43EC21BE9047/lbg64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
FC8E43EC21BE9047/lbg64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
1007BF65F80311D2/locker_ARM64
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral24
Sample
1007BF65F80311D2/locker_ARM64
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral25
Sample
1007BF65F80311D2/locker_ARM64
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral26
Sample
1007BF65F80311D2/locker_ARM64
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
Behavioral task
behavioral27
Sample
1007BF65F80311D2/locker_ARMV5
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral28
Sample
1007BF65F80311D2/locker_ARMV7
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral29
Sample
1007BF65F80311D2/locker_FREEBSD_AMD64
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral30
Sample
1007BF65F80311D2/locker_LINUX_I386
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral31
Sample
1007BF65F80311D2/locker_LINUX_X64
Resource
ubuntu2204-amd64-20240729-en
ubuntu-22.04-amd64
General
-
Target
1007BF65F80311D2/locker_LINUX_X64
-
Size
89KB
-
MD5
194a218bb7c8593df0621789488f6907
-
SHA1
89a60bc4e8b7c8188b8f3e96e799f2e455791f87
-
SHA256
6c5252c6653d82e1ff9f57cc0dc98e6d6c7a8c3405ffc418c5b94cc7e47cf057
-
SHA512
c9f32b7cdf3692a62a6e727148577bbdd753bac8df09f7c97075c50fd564ae780079ec3478e136c198027523b60767ab0d298ca01476361d299dc4eea9c0435b
-
SSDEEP
1536:h23bmHSlAhb6eo1xrac08UGNnPnEsT9VxU+tqRAsemhgYBzvI:4rmHSlAhbx+K8UUnPEsBVxDtqR19gAI
Malware Config
Signatures
-
Traces remote process 1 IoCs
pid Process 1567 locker_LINUX_X64 -
Reads AppArmor ptrace settings 1 TTPs 1 IoCs
Discovery of allowed ptrace capabilities by AppArmor.
description ioc Process File opened for reading /sys/kernel/security/apparmor/features/ptrace locker_LINUX_X64 -
Checks system information (zLinux) 1 TTPs 1 IoCs
Check system information on IBM zSystems which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/sysinfo lscpu -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/power locker_LINUX_X64 -
Reads network interface configuration 2 TTPs 12 IoCs
Fetches information about one or more active network interfaces.
description ioc Process File opened for reading /sys/devices/virtual/net/lo/power locker_LINUX_X64 File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/statistics locker_LINUX_X64 File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues locker_LINUX_X64 File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/rx-0 locker_LINUX_X64 File opened for reading /sys/devices/virtual/net/lo/statistics locker_LINUX_X64 File opened for reading /sys/devices/virtual/net/lo/queues/tx-0 locker_LINUX_X64 File opened for reading /sys/devices/virtual/net/lo/queues/tx-0/byte_queue_limits locker_LINUX_X64 File opened for reading /sys/devices/virtual/net/lo/queues/rx-0 locker_LINUX_X64 File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/power locker_LINUX_X64 File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/tx-0 locker_LINUX_X64 File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/tx-0/byte_queue_limits locker_LINUX_X64 File opened for reading /sys/devices/virtual/net/lo/queues locker_LINUX_X64 -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo lscpu -
Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size lscpu File opened for reading /sys/devices/system/cpu/cpu0/power locker_LINUX_X64 File opened for reading /sys/devices/system/cpu/cpu0/topology locker_LINUX_X64 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2 locker_LINUX_X64 File opened for reading /sys/devices/system/cpu/cpu0/topology/book_siblings lscpu File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/id lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/id lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/level lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/level lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size lscpu File opened for reading /sys/devices/system/cpu/vulnerabilities/l1tf lscpu File opened for reading /sys/devices/system/cpu/vulnerabilities/spectre_v1 lscpu File opened for reading /sys/devices/system/cpu/cpu0/topology/core_siblings lscpu File opened for reading /sys/devices/system/cpu/cpu0/topology/physical_package_id lscpu File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/id lscpu File opened for reading /sys/devices/system/cpu/smt locker_LINUX_X64 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/type lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/allocation_policy lscpu File opened for reading /sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/type lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index3 locker_LINUX_X64 File opened for reading /sys/devices/system/cpu/vulnerabilities/mds lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/coherency_line_size lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/allocation_policy lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/id lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache locker_LINUX_X64 File opened for reading /sys/devices/system/cpu/possible lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/ways_of_associativity lscpu File opened for reading /sys/devices/system/cpu/kernel_max lscpu File opened for reading /sys/devices/system/cpu/vulnerabilities/itlb_multihit lscpu File opened for reading /sys/devices/system/cpu/vulnerabilities/spectre_v2 lscpu File opened for reading /sys/devices/system/cpu/vulnerabilities/mmio_stale_data lscpu File opened for reading /sys/devices/system/cpu/vulnerabilities/gather_data_sampling lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/ways_of_associativity lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/physical_line_partition lscpu File opened for reading /sys/devices/system/cpu/vulnerabilities lscpu File opened for reading /sys/devices/system/cpu/vulnerabilities/srbds lscpu File opened for reading /sys/devices/system/cpu/cpu0/topology/thread_siblings lscpu File opened for reading /sys/devices/system/cpu/cpuidle locker_LINUX_X64 File opened for reading /sys/devices/system/cpu/power locker_LINUX_X64 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0 locker_LINUX_X64 File opened for reading /sys/devices/system/cpu/vulnerabilities/meltdown lscpu File opened for reading /sys/devices/system/cpu/cpu0/topology/drawer_siblings lscpu File opened for reading /sys/devices/system/cpu/cpu0/topology/core_id lscpu File opened for reading /sys/devices/system/cpu/cpu0/topology/book_id lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/allocation_policy lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index1 locker_LINUX_X64 File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/cpufreq/boost lscpu File opened for reading /sys/devices/system/cpu/vulnerabilities/tsx_async_abort lscpu File opened for reading /sys/devices/system/cpu/vulnerabilities/retbleed lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/level lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/ways_of_associativity lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/number_of_sets lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size lscpu File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/ways_of_associativity lscpu -
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/user.slice/user-0.slice/[email protected]/session.slice/org.gnome.SettingsDaemon.Housekeeping.service locker_LINUX_X64 File opened for reading /sys/module/scsi_dh_rdac/sections locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/qdisc/qdisc_dequeue locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/x86_fpu/x86_fpu_regs_deactivated locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/compaction/mm_compaction_kcompactd_wake locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/cpuhp/cpuhp_multi_enter locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_settimeofday locker_LINUX_X64 File opened for reading /sys/devices/platform/i8042/serio0/input/input1/input1::numlock locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/btrfs/update_bytes_may_use locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/syscalls/sys_exit_getuid locker_LINUX_X64 File opened for reading /sys/devices/pci0000:00/0000:00:04.0/ata7/link7/ata_link locker_LINUX_X64 File opened for reading /sys/module/i8042/parameters locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/btrfs/btrfs_skip_unused_block_group locker_LINUX_X64 File opened for reading /sys/devices/platform/floppy.0/block/fd0/queue locker_LINUX_X64 File opened for reading /sys/fs/cgroup/system.slice/system-getty.slice locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/xen/xen_cpu_write_idt_entry locker_LINUX_X64 File opened for reading /sys/devices/virtual/tty/tty50 locker_LINUX_X64 File opened for reading /sys/kernel/mm/swap locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/syscalls/sys_exit_rt_sigtimedwait locker_LINUX_X64 File opened for reading /sys/kernel/slab/dma-kmalloc-96 locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/smbus/smbus_write locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/xhci-hcd/xhci_discover_or_reset_device locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_enter_fchdir locker_LINUX_X64 File opened for reading /sys/module/blake2b_generic locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/syscalls/sys_enter_setsockopt locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/syscalls/sys_exit_nanosleep locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/syscalls/sys_enter_setgid locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_sched_getscheduler locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/xen locker_LINUX_X64 File opened for reading /sys/bus/mdio_bus/drivers/Broadcom BCM84881 locker_LINUX_X64 File opened for reading /sys/devices/virtual/vc/vcs3 locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/ext4/ext4_punch_hole locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/btrfs/btrfs_writepage_end_io_hook locker_LINUX_X64 File opened for reading /sys/kernel/debug/block/loop6/hctx0/cpu0 locker_LINUX_X64 File opened for reading /sys/class/nd locker_LINUX_X64 File opened for reading /sys/devices/pci0000:00/0000:00:04.0/ata4/host3/scsi_host locker_LINUX_X64 File opened for reading /sys/devices/virtual/tty/tty35 locker_LINUX_X64 File opened for reading /sys/module/crc_t10dif locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/tcp/tcp_probe locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/alarmtimer locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/syscalls/sys_exit_newfstat locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/syscalls/sys_enter_kcmp locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/btrfs/add_delayed_tree_ref locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_enter_sched_setparam locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/mdio locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/vmscan/mm_shrink_slab_end locker_LINUX_X64 File opened for reading /sys/kernel/slab/dma-kmalloc-512 locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/power/dev_pm_qos_add_request locker_LINUX_X64 File opened for reading /sys/devices/virtual/tty/tty56/power locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_newfstat locker_LINUX_X64 File opened for reading /sys/module/intel_idle locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/regulator/regulator_bypass_disable_complete locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/syscalls/sys_enter_shmat locker_LINUX_X64 File opened for reading /sys/kernel/tracing/events/initcall locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/ext4/ext4_es_insert_extent locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/irq_matrix/irq_matrix_reserve_managed locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/irq_matrix/irq_matrix_remove_managed locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/cgroup/cgroup_unfreeze locker_LINUX_X64 File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_enter_fsync locker_LINUX_X64 File opened for reading /sys/class/scsi_disk locker_LINUX_X64 File opened for reading /sys/devices/virtual/misc/tun/power locker_LINUX_X64 File opened for reading /sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:04 locker_LINUX_X64 File opened for reading /sys/bus/pci_express/drivers/aer locker_LINUX_X64 File opened for reading /sys/devices/virtual/tty/tty52 locker_LINUX_X64 -
description ioc Process File opened for reading /proc/113/net/netfilter locker_LINUX_X64 File opened for reading /proc/1057/task/1061/attr/smack locker_LINUX_X64 File opened for reading /proc/1161/task/1233/net/netfilter locker_LINUX_X64 File opened for reading /proc/1362/task/1362/fdinfo locker_LINUX_X64 File opened for reading /proc/1396/task/1396/fdinfo locker_LINUX_X64 File opened for reading /proc/113/status ps File opened for reading /proc/210/stat ps File opened for reading /proc/200/task/200/net/dev_snmp6 locker_LINUX_X64 File opened for reading /proc/413/attr locker_LINUX_X64 File opened for reading /proc/1214/task/1251/net/stat locker_LINUX_X64 File opened for reading /proc/77/task/77/attr/apparmor locker_LINUX_X64 File opened for reading /proc/1135/fdinfo locker_LINUX_X64 File opened for reading /proc/1453/task/1453/attr locker_LINUX_X64 File opened for reading /proc/159/fdinfo locker_LINUX_X64 File opened for reading /proc/721/fdinfo locker_LINUX_X64 File opened for reading /proc/1101/task/1102/fdinfo locker_LINUX_X64 File opened for reading /proc/1162/task/1198/net locker_LINUX_X64 File opened for reading /proc/1171/attr locker_LINUX_X64 File opened for reading /proc/24/net/dev_snmp6 locker_LINUX_X64 File opened for reading /proc/86/task/86/net locker_LINUX_X64 File opened for reading /proc/97/task/97/attr/smack locker_LINUX_X64 File opened for reading /proc/585/cmdline ps File opened for reading /proc/1315/task/1318 locker_LINUX_X64 File opened for reading /proc/639/task/652 locker_LINUX_X64 File opened for reading /proc/1094/task/1094/attr/apparmor locker_LINUX_X64 File opened for reading /proc/1186/attr locker_LINUX_X64 File opened for reading /proc/1077/task/1079/attr/apparmor locker_LINUX_X64 File opened for reading /proc/1396/task/1403/attr/smack locker_LINUX_X64 File opened for reading /proc/1488/task/1493/net locker_LINUX_X64 File opened for reading /proc/1135/stat ps File opened for reading /proc/869/task/967/net locker_LINUX_X64 File opened for reading /proc/1057/task/1062/net/dev_snmp6 locker_LINUX_X64 File opened for reading /proc/1175/task/1210/fd locker_LINUX_X64 File opened for reading /proc/110 locker_LINUX_X64 File opened for reading /proc/1178/task locker_LINUX_X64 File opened for reading /proc/1214/task/1214/attr/smack locker_LINUX_X64 File opened for reading /proc/592/ns locker_LINUX_X64 File opened for reading /proc/783/net/dev_snmp6 locker_LINUX_X64 File opened for reading /proc/990/net locker_LINUX_X64 File opened for reading /proc/1175/task locker_LINUX_X64 File opened for reading /proc/1240/task/1240 locker_LINUX_X64 File opened for reading /proc/408/status ps File opened for reading /proc/4/attr/smack locker_LINUX_X64 File opened for reading /proc/77/task/77/net/stat locker_LINUX_X64 File opened for reading /proc/783/task/783/attr/apparmor locker_LINUX_X64 File opened for reading /proc/20/cmdline ps File opened for reading /proc/102/fdinfo locker_LINUX_X64 File opened for reading /proc/159/task/159/fd locker_LINUX_X64 File opened for reading /proc/1080/task/1121/net/dev_snmp6 locker_LINUX_X64 File opened for reading /proc/1096/task/1106/net/dev_snmp6 locker_LINUX_X64 File opened for reading /proc/1347/attr locker_LINUX_X64 File opened for reading /proc/1488/task/1492 locker_LINUX_X64 File opened for reading /proc/1108/task/1109/attr locker_LINUX_X64 File opened for reading /proc/1162/task/1213/net locker_LINUX_X64 File opened for reading /proc/1196/task/1247 locker_LINUX_X64 File opened for reading /proc/745/task/745/attr locker_LINUX_X64 File opened for reading /proc/979/task/987/attr/apparmor locker_LINUX_X64 File opened for reading /proc/1094/task/1095/fdinfo locker_LINUX_X64 File opened for reading /proc/7/net locker_LINUX_X64 File opened for reading /proc/17/fd locker_LINUX_X64 File opened for reading /proc/23 locker_LINUX_X64 File opened for reading /proc/518/task/518/fd locker_LINUX_X64 File opened for reading /proc/689/task/689 locker_LINUX_X64 File opened for reading /proc/593/status ps -
Writes file to shm directory 1 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
description ioc Process File opened for modification /dev/shm/file93L7SH locker_LINUX_X64 -
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/filecgHKJL locker_LINUX_X64 File opened for modification /tmp/filexv79OA locker_LINUX_X64
Processes
-
/tmp/1007BF65F80311D2/locker_LINUX_X64/tmp/1007BF65F80311D2/locker_LINUX_X641⤵
- Traces remote process
- Reads AppArmor ptrace settings
- Reads hardware information
- Reads network interface configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to shm directory
- Writes file to tmp directory
PID:1567 -
/bin/shsh -c "vim-cmd hostsvc/hostsummary | grep cpuModel | cut -d '\"' -f2"2⤵PID:1568
-
/usr/bin/cutcut -d "\"" -f23⤵PID:1571
-
-
/usr/bin/grepgrep cpuModel3⤵PID:1570
-
-
-
/bin/shsh -c "lscpu | grep \"Model name\" | cut -d ':' -f2"2⤵PID:1572
-
/usr/bin/cutcut -d : -f23⤵PID:1575
-
-
/usr/bin/grepgrep "Model name"3⤵PID:1574
-
-
/usr/bin/lscpulscpu3⤵
- Checks system information (zLinux)
- Checks CPU configuration
- Reads CPU attributes
PID:1573
-
-
-
/bin/shsh -c "esxcli storage filesystem list | tail -n +3"2⤵PID:1576
-
/usr/bin/tailtail -n +33⤵PID:1578
-
-
-
/bin/shsh -c "lsblk -io KNAME,TYPE,SIZE,MODEL | tail -n +2"2⤵PID:1579
-
/usr/bin/tailtail -n +23⤵PID:1581
-
-
/usr/bin/lsblklsblk -io "KNAME,TYPE,SIZE,MODEL"3⤵PID:1580
-
-
-
/bin/shsh -c "uname -a"2⤵PID:1587
-
/usr/bin/unameuname -a3⤵PID:1589
-
-
-
/bin/shsh -c "vmware -v"2⤵PID:1590
-
-
/bin/shsh -c "ls -alR /vmfs/"2⤵PID:1594
-
/usr/bin/lsls -alR /vmfs/3⤵PID:1595
-
-
-
/bin/shsh -c "ps auxf"2⤵PID:1596
-
/usr/bin/psps auxf3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1597
-
-
-
/bin/shsh -c "df -h"2⤵PID:1598
-
/usr/bin/dfdf -h3⤵PID:1599
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
982.0MB
MD5b93ada4d395684f6c56ce4043f7896cd
SHA1a5582603cc3e1c7e83a230e8fdf9b6bf5d429981
SHA256428a7be92fd3968c482d1892787083250b314c300556286367960718c4601b2d
SHA512607507db929a5eccd05b015723199bbae5ee59037455bd6f479f8fb16b9225baae0579562559586cb55cb312622ccc508a772fadb166c9a8f59c770341a56d8d
-
Filesize
195.1MB
MD5e913c3f0000059bf0e0a16c7de883c1f
SHA1907bb08debfb4318a6c0605c719cbe93f09ddcee
SHA256e71b6f3d055f3af24851b4958307577e35fbd7df1f9420c16192f322022451f6
SHA512c3229bc858e81f53ea24c34267c9f4bc1edb4e3ee5a46249735f11c46729d591d05202eaee29f05825104042add15d4e6e09d90fc7a176c64ffc4cc48e98057a
-
Filesize
5.0MB
MD55f363e0e58a95f06cbe9bbc662c5dfb6
SHA12e95d7582c53583fa8afb54e0fe7a2597c92cbba
SHA256c036cbb7553a909f8b8877d4461924307f27ecb66cff928eeeafd569c3887e29
SHA512f1e554807f6e927530f7461e2ed5e8e3509c0245e082b2db5c88763a3764d1278b88d0d220f8b7050a71b2677e463fb7a3ad1d5b0fe6588c6ff18fddf977864c
-
Filesize
196.2MB
MD57f2177279877f038d9a3d563ce547beb
SHA1c9a0a684b93fc486a40878ffe9ca2e940fed2183
SHA2568cfacede3d9d1fcd38090020aa51f70f2e67df931bd3ab12293bef771f3e9656
SHA5125d221ef7ede3f7ab1fd3a4b981240c43a4d1ee5c477b10e555896b16f5b24385aa163ec0cec2941bf5e8feabb0a331b9a02df27bc5d5a35684026c7a229dc2a0
-
Filesize
499.8MB
MD59385aaf5ee1c19b95599271a2b30007f
SHA125ee50fc5aa6f533c435436533b0cf1dc0b6fff4
SHA2566200aaf23f7f00ea8b441d5a88f422519ec97e4a91cb2c1b5aeaa12a323826f6
SHA51260c65a64e3c22e8074af39b3dfebc4876db9c18b5b3a5fc6d56b53ad143c101ef10188467514830054c110aa85e53f8453d21624f07da244034d07fb5b0ad6ab
-
Filesize
500.4MB
MD51b2de90ae958041699c550e457b02e6d
SHA1915e92833b424ffb50fa7d63f87921869d8032cf
SHA2560db6ed529ea411053639ed2cf3ebd069dd08c715839b825a0f5481e8c590baa7
SHA51266d7fb5b9ea92865c9c215ea7f34e6c63ab0601065bc78dcabb8011aec0f83019868484b06ae63f306f3a55052215ceef6c8b82b1eff84513e9bfffa7ca2c732