Overview

overview

10

Static

static

10

329D6F9DDB...I_I386

ubuntu-18.04-amd64

329D6F9DDB...I_I386

ubuntu-20.04-amd64

329D6F9DDB...I_I386

ubuntu-22.04-amd64

329D6F9DDB...I_I386

ubuntu-24.04-amd64

329D6F9DDB...XI_X64

ubuntu-18.04-amd64

8

329D6F9DDB...XI_X64

ubuntu-20.04-amd64

8

329D6F9DDB...XI_X64

ubuntu-22.04-amd64

8

329D6F9DDB...XI_X64

ubuntu-24.04-amd64

8

Resubmissions

02-01-2025 21:27

250102-1arsfawnat 10

21-12-2024 14:36

241221-ryt32a1mhx 10

Analysis

  • max time kernel
    6s
  • max time network
    131s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    02-01-2025 21:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    329D6F9DDBF138D4/locker_ESXI_X64

  • Size

    93KB

  • MD5

    b76b092f5188ccc8a046ffb4659c3641

  • SHA1

    82e19d8b7bc5379528feb9c3a335d70d79358229

  • SHA256

    dd1cf10faf4e638bb5a0efeeaa4bc2f1c91557c22e93d3f135e7e7c7f0e7be55

  • SHA512

    bf06f2d65f7eca482066da6b1cace219cba2e2ebae0034de3e3bae429a2e821ea2d35a41534d6d9d159ae992ef0b5c5a268a48a05ae1fbb0da69a2122631653f

  • SSDEEP

    1536:Jv8RiloA2YObuLk8WKP/gCILnPG+atNoU+tqRAJy+p4G:1Zl/2Ym8LZOnPG+iNoDtqRaya

Score
8/10
credential_accessdiscoveryspywarestealer

Malware Config

Signatures

  • Traces remote process 1 IoCs
  • Reads user data of web browsers 3 TTPs 17 IoCs

    Reads stored browser data which can include saved credentials.

    spywarestealercredential_accessdiscovery
  • Reads AppArmor ptrace settings 1 TTPs 1 IoCs

    Discovery of allowed ptrace capabilities by AppArmor.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads hardware information 1 TTPs 1 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Reads network interface configuration 2 TTPs 12 IoCs

    Fetches information about one or more active network interfaces.

    discovery
  • Reads CPU attributes 1 TTPs 23 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/329D6F9DDBF138D4/locker_ESXI_X64
    /tmp/329D6F9DDBF138D4/locker_ESXI_X64
    1⤵
    • Traces remote process
    • Reads user data of web browsers
    • Reads AppArmor ptrace settings
    • Reads hardware information
    • Reads network interface configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    PID:1482
    • /bin/sh
      sh -c "vim-cmd hostsvc/hostsummary | grep cpuModel | cut -d '\"' -f2"
      2⤵
        PID:1483
        • /usr/bin/cut
          cut -d "\"" -f2
          3⤵
            PID:1486
          • /bin/grep
            grep cpuModel
            3⤵
              PID:1485
          • /bin/sh
            sh -c "esxcli storage filesystem list | tail -n +3"
            2⤵
              PID:1487
              • /usr/bin/tail
                tail -n +3
                3⤵
                  PID:1489
              • /bin/sh
                sh -c "lsblk -io KNAME,TYPE,SIZE,MODEL | tail -n +2"
                2⤵
                  PID:1490
                  • /usr/bin/tail
                    tail -n +2
                    3⤵
                      PID:1492
                    • /bin/lsblk
                      lsblk -io "KNAME,TYPE,SIZE,MODEL"
                      3⤵
                      • Enumerates kernel/hardware configuration
                      PID:1491
                  • /bin/sh
                    sh -c "uname -a"
                    2⤵
                      PID:1493
                      • /bin/uname
                        uname -a
                        3⤵
                          PID:1494
                      • /bin/sh
                        sh -c "vmware -v"
                        2⤵
                          PID:1495
                        • /bin/sh
                          sh -c "ls -alR /vmfs/"
                          2⤵
                            PID:1507
                            • /bin/ls
                              ls -alR /vmfs/
                              3⤵
                                PID:1508
                            • /bin/sh
                              sh -c "ps auxf"
                              2⤵
                                PID:1509
                                • /bin/ps
                                  ps auxf
                                  3⤵
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:1510

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads