Overview

overview

10

Static

static

10

329D6F9DDB...I_I386

ubuntu-18.04-amd64

329D6F9DDB...I_I386

ubuntu-20.04-amd64

329D6F9DDB...I_I386

ubuntu-22.04-amd64

329D6F9DDB...I_I386

ubuntu-24.04-amd64

329D6F9DDB...XI_X64

ubuntu-18.04-amd64

8

329D6F9DDB...XI_X64

ubuntu-20.04-amd64

8

329D6F9DDB...XI_X64

ubuntu-22.04-amd64

8

329D6F9DDB...XI_X64

ubuntu-24.04-amd64

8

Resubmissions

02-01-2025 21:27

250102-1arsfawnat 10

21-12-2024 14:36

241221-ryt32a1mhx 10

Analysis

  • max time kernel
    3s
  • max time network
    131s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240729-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240729-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    02-01-2025 21:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    329D6F9DDBF138D4/locker_ESXI_X64

  • Size

    93KB

  • MD5

    b76b092f5188ccc8a046ffb4659c3641

  • SHA1

    82e19d8b7bc5379528feb9c3a335d70d79358229

  • SHA256

    dd1cf10faf4e638bb5a0efeeaa4bc2f1c91557c22e93d3f135e7e7c7f0e7be55

  • SHA512

    bf06f2d65f7eca482066da6b1cace219cba2e2ebae0034de3e3bae429a2e821ea2d35a41534d6d9d159ae992ef0b5c5a268a48a05ae1fbb0da69a2122631653f

  • SSDEEP

    1536:Jv8RiloA2YObuLk8WKP/gCILnPG+atNoU+tqRAJy+p4G:1Zl/2Ym8LZOnPG+iNoDtqRaya

Score
8/10
credential_accessdiscoveryspywarestealer

Malware Config

Signatures

  • Traces remote process 1 IoCs
  • Reads user data of web browsers 3 TTPs 18 IoCs

    Reads stored browser data which can include saved credentials.

    spywarestealercredential_accessdiscovery
  • Reads AppArmor ptrace settings 1 TTPs 1 IoCs

    Discovery of allowed ptrace capabilities by AppArmor.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads hardware information 1 TTPs 1 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Reads network interface configuration 2 TTPs 12 IoCs

    Fetches information about one or more active network interfaces.

    discovery
  • Reads CPU attributes 1 TTPs 16 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/329D6F9DDBF138D4/locker_ESXI_X64
    /tmp/329D6F9DDBF138D4/locker_ESXI_X64
    1⤵
    • Traces remote process
    • Reads user data of web browsers
    • Reads AppArmor ptrace settings
    • Reads hardware information
    • Reads network interface configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    PID:1402
    • /bin/sh
      sh -c "vim-cmd hostsvc/hostsummary | grep cpuModel | cut -d '\"' -f2"
      2⤵
        PID:1403
        • /usr/bin/cut
          cut -d "\"" -f2
          3⤵
            PID:1406
          • /usr/bin/grep
            grep cpuModel
            3⤵
              PID:1405
          • /bin/sh
            sh -c "esxcli storage filesystem list | tail -n +3"
            2⤵
              PID:1407
              • /usr/bin/tail
                tail -n +3
                3⤵
                  PID:1409
              • /bin/sh
                sh -c "lsblk -io KNAME,TYPE,SIZE,MODEL | tail -n +2"
                2⤵
                  PID:1410
                  • /usr/bin/tail
                    tail -n +2
                    3⤵
                      PID:1412
                    • /usr/bin/lsblk
                      lsblk -io "KNAME,TYPE,SIZE,MODEL"
                      3⤵
                        PID:1411
                    • /bin/sh
                      sh -c "uname -a"
                      2⤵
                        PID:1413
                        • /usr/bin/uname
                          uname -a
                          3⤵
                            PID:1414
                        • /bin/sh
                          sh -c "vmware -v"
                          2⤵
                            PID:1415
                          • /bin/sh
                            sh -c "ls -alR /vmfs/"
                            2⤵
                              PID:1455
                              • /usr/bin/ls
                                ls -alR /vmfs/
                                3⤵
                                  PID:1456
                              • /bin/sh
                                sh -c "ps auxf"
                                2⤵
                                  PID:1457
                                  • /usr/bin/ps
                                    ps auxf
                                    3⤵
                                    • Reads CPU attributes
                                    • Reads runtime system information
                                    PID:1458

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads