Overview
overview
10Static
static
10329D6F9DDB...I_I386
ubuntu-24.04-amd64
329D6F9DDB...XI_X64
ubuntu-24.04-amd64
8LBB.exe
windows7-x64
9LBB.exe
windows10-2004-x64
9LBB_PS1.ps1
windows7-x64
5LBB_PS1.ps1
windows10-2004-x64
9LBB_PS1_ob...ed.ps1
windows7-x64
3LBB_PS1_ob...ed.ps1
windows10-2004-x64
3LBB_PS1_pass.ps1
windows7-x64
10LBB_PS1_pass.ps1
windows10-2004-x64
10LBB_Reflec...in.dll
windows7-x64
9LBB_Reflec...in.dll
windows10-2004-x64
7LBB_Rundll32.dll
windows7-x64
3LBB_Rundll32.dll
windows10-2004-x64
3LBB_Rundll32_pass.dll
windows7-x64
10LBB_Rundll32_pass.dll
windows10-2004-x64
10LBB_pass.exe
windows7-x64
10LBB_pass.exe
windows10-2004-x64
10FC8E43EC21...32.exe
windows7-x64
7FC8E43EC21...32.exe
windows10-2004-x64
7FC8E43EC21...64.exe
windows7-x64
7FC8E43EC21...64.exe
windows10-2004-x64
71007BF65F8..._ARM64
ubuntu-18.04-amd64
1007BF65F8..._ARM64
debian-9-armhf
1007BF65F8..._ARM64
debian-9-mips
1007BF65F8..._ARM64
debian-9-mipsel
1007BF65F8..._ARMV5
debian-9-armhf
81007BF65F8..._ARMV7
debian-9-armhf
81007BF65F8..._AMD64
ubuntu-24.04-amd64
1007BF65F8...X_I386
ubuntu-22.04-amd64
1007BF65F8...UX_X64
ubuntu-22.04-amd64
81007BF65F8...r_MIPS
debian-9-mips
8Analysis
-
max time kernel
7s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
19-12-2024 22:25
Behavioral task
behavioral1
Sample
329D6F9DDBF138D4/locker_ESXI_I386
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral2
Sample
329D6F9DDBF138D4/locker_ESXI_X64
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral3
Sample
LBB.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
LBB.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
LBB_PS1.ps1
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
LBB_PS1.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
LBB_PS1_obfuscated.ps1
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral8
Sample
LBB_PS1_obfuscated.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
LBB_PS1_pass.ps1
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
LBB_PS1_pass.ps1
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
LBB_ReflectiveDll_DllMain.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
LBB_ReflectiveDll_DllMain.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
LBB_Rundll32.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral14
Sample
LBB_Rundll32.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
LBB_Rundll32_pass.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
LBB_Rundll32_pass.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
LBB_pass.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral18
Sample
LBB_pass.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
FC8E43EC21BE9047/lbg32.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
FC8E43EC21BE9047/lbg32.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
FC8E43EC21BE9047/lbg64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
FC8E43EC21BE9047/lbg64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
1007BF65F80311D2/locker_ARM64
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral24
Sample
1007BF65F80311D2/locker_ARM64
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral25
Sample
1007BF65F80311D2/locker_ARM64
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral26
Sample
1007BF65F80311D2/locker_ARM64
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
Behavioral task
behavioral27
Sample
1007BF65F80311D2/locker_ARMV5
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral28
Sample
1007BF65F80311D2/locker_ARMV7
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral29
Sample
1007BF65F80311D2/locker_FREEBSD_AMD64
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral30
Sample
1007BF65F80311D2/locker_LINUX_I386
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral31
Sample
1007BF65F80311D2/locker_LINUX_X64
Resource
ubuntu2204-amd64-20240729-en
ubuntu-22.04-amd64
General
-
Target
1007BF65F80311D2/locker_MIPS
-
Size
126KB
-
MD5
9700dc992a950aa6e76d8d4de5ceff38
-
SHA1
45dba47c0c0358627ae1a79463ed981017d30643
-
SHA256
9c7ff1b686e05948de8d3e51dec88ff21b9b69418a10ba3e08de340f4503c064
-
SHA512
68649687288f1dbe2e0dc202837579467eb2bc31e411d394431257fc5e3085db7283846741385e9d059bb11162bf53865e211a2d36fe8159125a377521ceff13
-
SSDEEP
1536:SXzYBjV+P1NVt1dFMMaH6HULoecIJnvjK2WIAb92aUeX/ZbnBUZulb9S4AbIPLxQ:SXzKx/FLWI7kQ4/tnU04+jOoa
Malware Config
Signatures
-
Traces remote process 1 IoCs
pid Process 729 locker_MIPS -
Checks system information (zLinux) 1 TTPs 1 IoCs
Check system information on IBM zSystems which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/sysinfo lscpu -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo lscpu -
Reads CPU attributes 1 TTPs 8 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online lscpu File opened for reading /sys/devices/system/cpu/cpu0/topology/thread_siblings lscpu File opened for reading /sys/devices/system/cpu/cpu0/topology/core_siblings lscpu File opened for reading /sys/devices/system/cpu/cpu0/topology/core_id lscpu File opened for reading /sys/devices/system/cpu/cpu0/topology/physical_package_id lscpu File opened for reading /sys/devices/system/cpu/kernel_max lscpu File opened for reading /sys/devices/system/cpu/possible lscpu File opened for reading /sys/devices/system/cpu/present lscpu -
Enumerates kernel/hardware configuration 1 TTPs 13 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/firmware/efi/systab lscpu File opened for reading /sys/block/sda/dev lsblk File opened for reading /sys/dev/block/8:0 lsblk File opened for reading /sys/dev/block/8:1 lsblk File opened for reading /sys/block/sda/sda2/dev lsblk File opened for reading /sys/dev/block/8:2 lsblk File opened for reading /sys/block/sda/sda5/dev lsblk File opened for reading /sys/dev/block/8:5 lsblk File opened for reading /sys/devices/system/node lscpu File opened for reading /sys/block lsblk File opened for reading /sys/block/sr0/dev lsblk File opened for reading /sys/dev/block/11:0 lsblk File opened for reading /sys/block/sda/sda1/dev lsblk -
description ioc Process File opened for reading /proc/fs/nfsd locker_MIPS File opened for reading /proc/irq/1 locker_MIPS File opened for reading /proc/irq/15/ata_piix locker_MIPS File opened for reading /proc/irq/20 locker_MIPS File opened for reading /proc/sys/debug locker_MIPS File opened for reading /proc/efi/systab lscpu File opened for reading /proc/self/status lscpu File opened for reading /proc/irq/10 locker_MIPS File opened for reading /proc/irq/11/uhci_hcd:usb2 locker_MIPS File opened for reading /proc/irq/15 locker_MIPS File opened for reading /proc/irq/18 locker_MIPS File opened for reading /proc/sys/dev/tty locker_MIPS File opened for reading /proc/device-tree/compatible lscpu File opened for reading /proc/irq/12 locker_MIPS File opened for reading /proc/sys/dev/cdrom locker_MIPS File opened for reading /proc/irq/10/ehci_hcd:usb1 locker_MIPS File opened for reading /proc/irq/0 locker_MIPS File opened for reading /proc/irq/3 locker_MIPS File opened for reading /proc/irq/23 locker_MIPS File opened for reading /proc/bus locker_MIPS File opened for reading /proc/irq/4 locker_MIPS File opened for reading /proc/irq/17 locker_MIPS File opened for reading /proc/irq locker_MIPS File opened for reading /proc/irq/6 locker_MIPS File opened for reading /proc/irq/19 locker_MIPS File opened for reading /proc/sys locker_MIPS File opened for reading /proc/sys/dev locker_MIPS File opened for reading /proc/irq/16 locker_MIPS File opened for reading /proc/sys/kernel/osrelease lscpu File opened for reading /proc/bus/pci/devices lscpu File opened for reading /proc/fs/ext4/sda1 locker_MIPS File opened for reading /proc/bus/pci/00 locker_MIPS File opened for reading /proc/irq/8/rtc0 locker_MIPS File opened for reading /proc/irq/14 locker_MIPS File opened for reading /proc/irq/14/ata_piix locker_MIPS File opened for reading /proc/irq/2 locker_MIPS File opened for reading /proc/irq/4/serial locker_MIPS File opened for reading /proc/fs/jbd2 locker_MIPS File opened for reading /proc/fs/jbd2/sda1-8 locker_MIPS File opened for reading /proc/bus/pci locker_MIPS File opened for reading /proc/irq/11 locker_MIPS File opened for reading /proc/irq/13 locker_MIPS File opened for reading /proc/irq/8 locker_MIPS File opened for reading /proc/sys/fs/binfmt_misc locker_MIPS File opened for reading /proc/fs locker_MIPS File opened for reading /proc/irq/5 locker_MIPS File opened for reading /proc/irq/9 locker_MIPS File opened for reading /proc/irq/10/enp0s19 locker_MIPS File opened for reading /proc/irq/21 locker_MIPS File opened for reading /proc/sys/fs locker_MIPS File opened for reading /proc/filesystems lsblk File opened for reading /proc/fs/ext4 locker_MIPS File opened for reading /proc/bus/input locker_MIPS File opened for reading /proc/irq/7 locker_MIPS File opened for reading /proc/irq/22 locker_MIPS File opened for reading /proc/sys/dev/scsi locker_MIPS -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 729 locker_MIPS
Processes
-
/tmp/1007BF65F80311D2/locker_MIPS/tmp/1007BF65F80311D2/locker_MIPS1⤵
- Traces remote process
- Reads runtime system information
- System Network Configuration Discovery
PID:729 -
/bin/shsh -c "vim-cmd hostsvc/hostsummary | grep cpuModel | cut -d '\"' -f2"2⤵PID:732
-
/bin/grepgrep cpuModel3⤵PID:734
-
-
/usr/bin/cutcut -d "\"" -f23⤵PID:736
-
-
-
/bin/shsh -c "lscpu | grep \"Model name\" | cut -d ':' -f2"2⤵PID:739
-
/bin/grepgrep "Model name"3⤵PID:741
-
-
/usr/bin/cutcut -d : -f23⤵PID:742
-
-
/usr/bin/lscpulscpu3⤵
- Checks system information (zLinux)
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:740
-
-
-
/bin/shsh -c "esxcli storage filesystem list | tail -n +3"2⤵PID:744
-
/usr/bin/tailtail -n +33⤵PID:748
-
-
-
/bin/shsh -c "lsblk -io KNAME,TYPE,SIZE,MODEL | tail -n +2"2⤵PID:750
-
/usr/bin/tailtail -n +23⤵PID:753
-
-
/bin/lsblklsblk -io "KNAME,TYPE,SIZE,MODEL"3⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:752
-
-
-
/bin/shsh -c "uname -a"2⤵PID:756
-
/bin/unameuname -a3⤵PID:758
-
-
-
/bin/shsh -c "vmware -v"2⤵PID:759
-