Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240729-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240729-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    18/01/2025, 04:28

General

  • Target

    The-MALWARE-Repo-master/Botnets/FritzFrog/30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01

  • Size

    8.6MB

  • MD5

    819b0fdb2b9c8a440b734a7b72522f12

  • SHA1

    f3aff7e1c44d21508eb60797211570c84a53597a

  • SHA256

    30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01

  • SHA512

    fee2c0dbbc91e2486e409e8b6a877c6ec500e6c7c0491d4c44d37006c30de79b95dd4640c7c8c8efcc920abccbdb659a590fde1e2526126279b7486778d08b5a

  • SSDEEP

    98304:zhPTaS9ki2kJxOU/ci9Z6uHFg3+QIEvRihdF7Xk:dPTaS9kitnEi9Z6uHq3+XE8z

Malware Config

Signatures

  • Adds new SSH keys 1 TTPs 1 IoCs

    Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

  • Deletes itself 1 IoCs
  • Deletes log files 1 TTPs 1 IoCs

    Deletes log files on the system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Virtualization/Sandbox Evasion: Time Based Evasion 1 TTPs 15 IoCs

    Adversaries may detect and evade virtualized environments and sandboxes.

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
    /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
    1⤵
    • Adds new SSH keys
    • Deletes itself
    • Deletes log files
    • Reads runtime system information
    • Writes file to tmp directory
    PID:2467
    • /usr/bin/uname
      uname -a
      2⤵
        PID:2482
      • /usr/bin/cat
        cat /proc/cpuinfo
        2⤵
        • Checks CPU configuration
        PID:2483
      • /usr/bin/cat
        cat /etc/issue
        2⤵
          PID:2485
        • /usr/bin/free
          free -m
          2⤵
            PID:2486
          • /usr/bin/uptime
            uptime
            2⤵
            • Virtualization/Sandbox Evasion: Time Based Evasion
            PID:2487
          • /usr/bin/journalctl
            journalctl -S "@0" -u sshd
            2⤵
              PID:2494
            • /usr/bin/cat
              cat "/var/log/auth*"
              2⤵
                PID:2496
              • /usr/bin/zcat
                zcat "/var/log/auth*"
                2⤵
                  PID:2497
                • /usr/local/sbin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                  • System Network Configuration Discovery
                  PID:2497
                • /usr/local/bin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                  • System Network Configuration Discovery
                  PID:2497
                • /usr/sbin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                  • System Network Configuration Discovery
                  PID:2497
                • /usr/bin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                  • System Network Configuration Discovery
                  PID:2497
                • /usr/bin/free
                  free -m
                  2⤵
                    PID:2498
                  • /usr/bin/uptime
                    uptime
                    2⤵
                    • Virtualization/Sandbox Evasion: Time Based Evasion
                    PID:2499
                  • /usr/bin/free
                    free -m
                    2⤵
                      PID:2500
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Virtualization/Sandbox Evasion: Time Based Evasion
                      PID:2501
                    • /usr/bin/free
                      free -m
                      2⤵
                        PID:2505
                      • /usr/bin/uptime
                        uptime
                        2⤵
                        • Virtualization/Sandbox Evasion: Time Based Evasion
                        PID:2506
                      • /usr/bin/free
                        free -m
                        2⤵
                          PID:2507
                        • /usr/bin/uptime
                          uptime
                          2⤵
                          • Virtualization/Sandbox Evasion: Time Based Evasion
                          • Reads runtime system information
                          PID:2508
                        • /usr/bin/free
                          free -m
                          2⤵
                            PID:2509
                          • /usr/bin/uptime
                            uptime
                            2⤵
                            • Virtualization/Sandbox Evasion: Time Based Evasion
                            PID:2510
                          • /usr/bin/free
                            free -m
                            2⤵
                              PID:2511
                            • /usr/bin/uptime
                              uptime
                              2⤵
                              • Virtualization/Sandbox Evasion: Time Based Evasion
                              • Reads runtime system information
                              PID:2512
                            • /usr/bin/free
                              free -m
                              2⤵
                                PID:2513
                              • /usr/bin/uptime
                                uptime
                                2⤵
                                • Virtualization/Sandbox Evasion: Time Based Evasion
                                PID:2514
                              • /usr/bin/free
                                free -m
                                2⤵
                                  PID:2515
                                • /usr/bin/uptime
                                  uptime
                                  2⤵
                                  • Virtualization/Sandbox Evasion: Time Based Evasion
                                  • Reads runtime system information
                                  PID:2516
                                • /usr/bin/free
                                  free -m
                                  2⤵
                                    PID:2517
                                  • /usr/bin/uptime
                                    uptime
                                    2⤵
                                    • Virtualization/Sandbox Evasion: Time Based Evasion
                                    PID:2518
                                  • /usr/bin/free
                                    free -m
                                    2⤵
                                      PID:2519
                                    • /usr/bin/uptime
                                      uptime
                                      2⤵
                                      • Virtualization/Sandbox Evasion: Time Based Evasion
                                      PID:2520
                                    • /usr/bin/free
                                      free -m
                                      2⤵
                                        PID:2521
                                      • /usr/bin/uptime
                                        uptime
                                        2⤵
                                        • Virtualization/Sandbox Evasion: Time Based Evasion
                                        PID:2522
                                      • /usr/bin/free
                                        free -m
                                        2⤵
                                          PID:2538
                                        • /usr/bin/uptime
                                          uptime
                                          2⤵
                                          • Virtualization/Sandbox Evasion: Time Based Evasion
                                          PID:2539
                                        • /usr/bin/free
                                          free -m
                                          2⤵
                                            PID:2543
                                          • /usr/bin/uptime
                                            uptime
                                            2⤵
                                            • Virtualization/Sandbox Evasion: Time Based Evasion
                                            PID:2544
                                          • /usr/bin/free
                                            free -m
                                            2⤵
                                              PID:2545
                                            • /usr/bin/uptime
                                              uptime
                                              2⤵
                                              • Virtualization/Sandbox Evasion: Time Based Evasion
                                              • Reads runtime system information
                                              PID:2546

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/nc

                                            Filesize

                                            8.6MB

                                            MD5

                                            819b0fdb2b9c8a440b734a7b72522f12

                                            SHA1

                                            f3aff7e1c44d21508eb60797211570c84a53597a

                                            SHA256

                                            30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01

                                            SHA512

                                            fee2c0dbbc91e2486e409e8b6a877c6ec500e6c7c0491d4c44d37006c30de79b95dd4640c7c8c8efcc920abccbdb659a590fde1e2526126279b7486778d08b5a