Analysis
-
max time kernel
64s -
max time network
133s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
31-01-2025 04:21
Behavioral task
behavioral1
Sample
ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf
-
Size
83KB
-
MD5
8c6e6dc4f224e20117ff59bdf8fe79bf
-
SHA1
9dc4b87c2a0762e8aa969c4ef6ebd52c52a4a5eb
-
SHA256
ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867
-
SHA512
519b7a62010b422135077c7900b3590a381d701c789ff9c4ad45d091ec1b657d29d61fb2037f4a5113a63e2b05fb3bad25e61d136dd54a4347059c6f5dab299e
-
SSDEEP
1536:GTqRR2Rm+KCVWMLN3kHEIbAjp6gaDMQc1DI1MwUwl4jz1uhOTo8DBDYTIIM:62Rgm+H1LN27bAFNagQc1s2wUwo1uhOH
Malware Config
Extracted
mirai
UNSTABLE
dkdrlahhwlxptmxm2.p-e.kr
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 4 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 2503 sh 2504 chmod 2636 sh 2637 chmod -
Executes dropped EXE 44 IoCs
ioc pid Process /tmp/filenISzvg 2450 ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf /tmp/file2sAVof 2457 filenISzvg /tmp/file5sxual 2458 file2sAVof /tmp/fileJTAZ4R 2459 file5sxual /tmp/file1OkePG 2460 fileJTAZ4R /tmp/fileHHairg 2461 file1OkePG /tmp/filejm90o2 2462 fileHHairg /tmp/fileqMQgNn 2463 filejm90o2 /tmp/fileAWSZQA 2464 fileqMQgNn /tmp/filerbTviK 2465 fileAWSZQA /tmp/filebMEmrf 2466 filerbTviK /tmp/filec4Utf7 2467 filebMEmrf /tmp/fileyoXFys 2468 filec4Utf7 /tmp/filegj4uEM 2469 fileyoXFys /tmp/fileY4G4NT 2470 filegj4uEM /tmp/fileCtliVr 2471 fileY4G4NT /tmp/filekKa1D7 2472 fileCtliVr /tmp/fileC86F7l 2473 filekKa1D7 /tmp/fileRLK6lB 2474 fileC86F7l /tmp/fileSQBen5 2478 fileRLK6lB /tmp/file3phePm 2479 fileSQBen5 /tmp/fileOMZcn8 2480 file3phePm /tmp/fileNwMyLP 2481 fileOMZcn8 /tmp/filetkOzDe 2482 fileNwMyLP /tmp/filetIPbWB 2483 filetkOzDe /tmp/file0FCJDG 2484 filetIPbWB /tmp/fileWDO9me 2485 file0FCJDG /tmp/filewLHQtf 2486 fileWDO9me /tmp/filewFGopI 2487 filewLHQtf /tmp/fileHQpz5C 2488 filewFGopI /tmp/fileIqqRp1 2489 fileHQpz5C /tmp/file8HPUQ2 2490 fileIqqRp1 /tmp/filek6XUU3 2491 file8HPUQ2 /tmp/filehaZEyr 2492 filek6XUU3 /tmp/fileJh5fCj 2493 filehaZEyr /tmp/file0HK4az 2494 fileJh5fCj /tmp/fileW4p3EV 2495 file0HK4az /tmp/fileXnPjCv 2496 fileW4p3EV /tmp/fileWGVg1E 2497 fileXnPjCv /tmp/file7nNhgY 2498 fileWGVg1E /tmp/file8k1sbi 2499 file7nNhgY /tmp/fileMhS24H 2500 file8k1sbi /tmp/fileJ56vDb 2501 fileMhS24H /tmp/filemPSLCh 2502 fileJ56vDb -
Creates/modifies Cron job 1 TTPs 44 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/cron.hourly/0 fileOMZcn8 File opened for modification /etc/cron.hourly/0 fileNwMyLP File opened for modification /etc/cron.hourly/0 file0FCJDG File opened for modification /etc/cron.hourly/0 fileHQpz5C File opened for modification /etc/cron.hourly/0 file2sAVof File opened for modification /etc/cron.hourly/0 file5sxual File opened for modification /etc/cron.hourly/0 fileyoXFys File opened for modification /etc/cron.hourly/0 file3phePm File opened for modification /etc/cron.hourly/0 filek6XUU3 File opened for modification /etc/cron.hourly/0 fileMhS24H File opened for modification /etc/cron.hourly/0 fileWGVg1E File opened for modification /etc/cron.hourly/0 file8k1sbi File opened for modification /etc/cron.hourly/0 filenISzvg File opened for modification /etc/cron.hourly/0 fileqMQgNn File opened for modification /etc/cron.hourly/0 filetIPbWB File opened for modification /etc/cron.hourly/0 filewLHQtf File opened for modification /etc/cron.hourly/0 fileJ56vDb File opened for modification /etc/cron.hourly/0 file1OkePG File opened for modification /etc/cron.hourly/0 filegj4uEM File opened for modification /etc/cron.hourly/0 fileCtliVr File opened for modification /etc/cron.hourly/0 filetkOzDe File opened for modification /etc/cron.hourly/0 fileIqqRp1 File opened for modification /etc/cron.hourly/0 fileXnPjCv File opened for modification /etc/cron.hourly/0 ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf File opened for modification /etc/cron.hourly/0 fileHHairg File opened for modification /etc/cron.hourly/0 fileAWSZQA File opened for modification /etc/cron.hourly/0 filec4Utf7 File opened for modification /etc/cron.hourly/0 fileSQBen5 File opened for modification /etc/cron.hourly/0 fileWDO9me File opened for modification /etc/cron.hourly/0 file8HPUQ2 File opened for modification /etc/cron.hourly/0 filehaZEyr File opened for modification /etc/cron.hourly/0 filejm90o2 File opened for modification /etc/cron.hourly/0 filerbTviK File opened for modification /etc/cron.hourly/0 filebMEmrf File opened for modification /etc/cron.hourly/0 fileRLK6lB File opened for modification /etc/cron.hourly/0 file0HK4az File opened for modification /etc/cron.hourly/0 file7nNhgY File opened for modification /etc/cron.hourly/0 fileJTAZ4R File opened for modification /etc/cron.hourly/0 filekKa1D7 File opened for modification /etc/cron.hourly/0 fileW4p3EV File opened for modification /etc/cron.hourly/0 fileC86F7l File opened for modification /etc/cron.hourly/0 fileJh5fCj File opened for modification /etc/cron.hourly/0 fileY4G4NT File opened for modification /etc/cron.hourly/0 filewFGopI -
Creates/modifies environment variables 1 TTPs 3 IoCs
Creating/modifying environment variables is a common persistence mechanism.
description ioc Process File opened for modification /etc/profile filemPSLCh File opened for modification /etc/bash.bashrc filemPSLCh File opened for modification /home/user/.bash_profile filemPSLCh -
description ioc Process File opened for modification /etc/init.d/holdservice filemPSLCh -
Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc.local filemPSLCh -
Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
description ioc Process File opened for modification /etc/systemd/system/holdservice.service filemPSLCh -
Writes file to system bin folder 1 IoCs
description ioc Process File opened for modification /bin/ls ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf -
Modifies Bash startup script 2 TTPs 3 IoCs
description ioc Process File opened for modification /etc/profile filemPSLCh File opened for modification /etc/bash.bashrc filemPSLCh File opened for modification /home/user/.bash_profile filemPSLCh -
description ioc Process File opened for reading /proc/self/exe file1OkePG File opened for reading /proc/self/exe filec4Utf7 File opened for reading /proc/self/exe filetIPbWB File opened for reading /proc/self/exe filewFGopI File opened for reading /proc/self/exe fileHQpz5C File opened for reading /proc/self/exe fileMhS24H File opened for reading /proc/self/exe ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf File opened for reading /proc/self/exe fileJTAZ4R File opened for reading /proc/self/exe fileyoXFys File opened for reading /proc/self/exe fileY4G4NT File opened for reading /proc/self/exe filekKa1D7 File opened for reading /proc/self/exe fileC86F7l File opened for reading /proc/self/exe file8HPUQ2 File opened for reading /proc/self/exe file8k1sbi File opened for reading /proc/self/exe file2sAVof File opened for reading /proc/self/exe fileHHairg File opened for reading /proc/self/exe filejm90o2 File opened for reading /proc/self/exe fileRLK6lB File opened for reading /proc/self/exe fileOMZcn8 File opened for reading /proc/self/exe filewLHQtf File opened for reading /proc/filesystems systemctl File opened for reading /proc/self/exe fileSQBen5 File opened for reading /proc/self/exe file0HK4az File opened for reading /proc/self/exe file7nNhgY File opened for reading /proc/filesystems systemctl File opened for reading /proc/self/exe filerbTviK File opened for reading /proc/self/exe file3phePm File opened for reading /proc/self/exe filetkOzDe File opened for reading /proc/self/exe file0FCJDG File opened for reading /proc/self/exe fileAWSZQA File opened for reading /proc/self/exe filek6XUU3 File opened for reading /proc/self/exe fileJh5fCj File opened for reading /proc/self/exe fileJ56vDb File opened for reading /proc/self/exe fileqMQgNn File opened for reading /proc/self/exe filebMEmrf File opened for reading /proc/self/exe fileWDO9me File opened for reading /proc/self/exe fileIqqRp1 File opened for reading /proc/self/exe fileW4p3EV File opened for reading /proc/self/exe fileXnPjCv File opened for reading /proc/self/exe fileWGVg1E File opened for reading /proc/self/exe filenISzvg File opened for reading /proc/self/exe file5sxual File opened for reading /proc/self/exe filegj4uEM File opened for reading /proc/self/exe fileCtliVr File opened for reading /proc/self/exe fileNwMyLP File opened for reading /proc/self/exe filehaZEyr -
Writes file to tmp directory 44 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/filejm90o2 fileHHairg File opened for modification /tmp/fileCtliVr fileY4G4NT File opened for modification /tmp/filekKa1D7 fileCtliVr File opened for modification /tmp/file8k1sbi file7nNhgY File opened for modification /tmp/file5sxual file2sAVof File opened for modification /tmp/fileHHairg file1OkePG File opened for modification /tmp/filec4Utf7 filebMEmrf File opened for modification /tmp/fileNwMyLP fileOMZcn8 File opened for modification /tmp/filetIPbWB filetkOzDe File opened for modification /tmp/filewLHQtf fileWDO9me File opened for modification /tmp/fileY4G4NT filegj4uEM File opened for modification /tmp/fileC86F7l filekKa1D7 File opened for modification /tmp/fileOMZcn8 file3phePm File opened for modification /tmp/filewFGopI filewLHQtf File opened for modification /tmp/fileWGVg1E fileXnPjCv File opened for modification /tmp/filenISzvg ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf File opened for modification /tmp/file2sAVof filenISzvg File opened for modification /tmp/fileSQBen5 fileRLK6lB File opened for modification /tmp/file3phePm fileSQBen5 File opened for modification /tmp/file7nNhgY fileWGVg1E File opened for modification /tmp/fileMhS24H file8k1sbi File opened for modification /tmp/fileJ56vDb fileMhS24H File opened for modification /tmp/fileAWSZQA fileqMQgNn File opened for modification /tmp/filegj4uEM fileyoXFys File opened for modification /tmp/fileRLK6lB fileC86F7l File opened for modification /tmp/filetkOzDe fileNwMyLP File opened for modification /tmp/fileWDO9me file0FCJDG File opened for modification /tmp/filehaZEyr filek6XUU3 File opened for modification /tmp/fileJTAZ4R file5sxual File opened for modification /tmp/fileqMQgNn filejm90o2 File opened for modification /tmp/filerbTviK fileAWSZQA File opened for modification /tmp/file0FCJDG filetIPbWB File opened for modification /tmp/file1OkePG fileJTAZ4R File opened for modification /tmp/filebMEmrf filerbTviK File opened for modification /tmp/fileyoXFys filec4Utf7 File opened for modification /tmp/fileIqqRp1 fileHQpz5C File opened for modification /tmp/fileXnPjCv fileW4p3EV File opened for modification /tmp/filemPSLCh fileJ56vDb File opened for modification /tmp/fileHQpz5C filewFGopI File opened for modification /tmp/file8HPUQ2 fileIqqRp1 File opened for modification /tmp/filek6XUU3 file8HPUQ2 File opened for modification /tmp/fileJh5fCj filehaZEyr File opened for modification /tmp/file0HK4az fileJh5fCj File opened for modification /tmp/fileW4p3EV file0HK4az
Processes
-
/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to system bin folder
- Reads runtime system information
- Writes file to tmp directory
PID:2433 -
/tmp/filenISzvg/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf2⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2450 -
/tmp/file2sAVof/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf3⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2457 -
/tmp/file5sxual/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf4⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2458 -
/tmp/fileJTAZ4R/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf5⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2459 -
/tmp/file1OkePG/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf6⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2460 -
/tmp/fileHHairg/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf7⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2461 -
/tmp/filejm90o2/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf8⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2462 -
/tmp/fileqMQgNn/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf9⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2463 -
/tmp/fileAWSZQA/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf10⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2464 -
/tmp/filerbTviK/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf11⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2465 -
/tmp/filebMEmrf/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf12⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2466 -
/tmp/filec4Utf7/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf13⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2467 -
/tmp/fileyoXFys/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf14⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2468 -
/tmp/filegj4uEM/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf15⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2469 -
/tmp/fileY4G4NT/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf16⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2470 -
/tmp/fileCtliVr/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf17⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2471 -
/tmp/filekKa1D7/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf18⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2472 -
/tmp/fileC86F7l/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf19⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2473 -
/tmp/fileRLK6lB/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf20⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2474 -
/tmp/fileSQBen5/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf21⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2478 -
/tmp/file3phePm/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf22⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2479 -
/tmp/fileOMZcn8/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf23⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2480 -
/tmp/fileNwMyLP/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf24⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2481 -
/tmp/filetkOzDe/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf25⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2482 -
/tmp/filetIPbWB/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf26⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2483 -
/tmp/file0FCJDG/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf27⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2484 -
/tmp/fileWDO9me/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf28⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2485 -
/tmp/filewLHQtf/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf29⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2486 -
/tmp/filewFGopI/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf30⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2487 -
/tmp/fileHQpz5C/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf31⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2488 -
/tmp/fileIqqRp1/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf32⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2489 -
/tmp/file8HPUQ2/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf33⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2490 -
/tmp/filek6XUU3/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf34⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2491 -
/tmp/filehaZEyr/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf35⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2492 -
/tmp/fileJh5fCj/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf36⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2493 -
/tmp/file0HK4az/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf37⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2494 -
/tmp/fileW4p3EV/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf38⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2495 -
/tmp/fileXnPjCv/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf39⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2496 -
/tmp/fileWGVg1E/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf40⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2497 -
/tmp/file7nNhgY/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf41⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2498 -
/tmp/file8k1sbi/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf42⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2499 -
/tmp/fileMhS24H/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf43⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2500 -
/tmp/fileJ56vDb/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf44⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:2501 -
/tmp/filemPSLCh/tmp/ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867.elf45⤵
- Creates/modifies environment variables
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Modifies Bash startup script
PID:2502 -
/bin/shsh -c "chmod +x /etc/systemd/system/holdservice.service"46⤵
- File and Directory Permissions Modification
PID:2503 -
/usr/bin/chmodchmod +x /etc/systemd/system/holdservice.service47⤵
- File and Directory Permissions Modification
PID:2504
-
-
-
/bin/shsh -c "systemctl enable holdservice.service"46⤵PID:2505
-
/usr/bin/systemctlsystemctl enable holdservice.service47⤵
- Reads runtime system information
PID:2506
-
-
-
/bin/shsh -c "systemctl start holdservice.service"46⤵PID:2631
-
/usr/bin/systemctlsystemctl start holdservice.service47⤵
- Reads runtime system information
PID:2632
-
-
-
/bin/shsh -c "chmod +x /etc/init.d/holdservice"46⤵
- File and Directory Permissions Modification
PID:2636 -
/usr/bin/chmodchmod +x /etc/init.d/holdservice47⤵
- File and Directory Permissions Modification
PID:2637
-
-
-
/bin/shsh -c "ln -s /etc/init.d/holdservice /etc/rc.d/"46⤵PID:2638
-
/usr/bin/lnln -s /etc/init.d/holdservice /etc/rc.d/47⤵PID:2639
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD53f006f7f81fc17be7f4a0d3da0fad5de
SHA197a94d3d0654c6551057af3809b52572bd7f9f5d
SHA256982f9e0f089b91ba79df723435099df15c72e1201a45010ee60226ab136c93bf
SHA51297d2ac0057427b940ada7c0fc805c1966e2535c3c3767ca85fef4a7e0fdc9d4ef9eb133530408b1e439df067881cb317e948ad9bfd487e958a04c97d9db978e0
-
Filesize
65B
MD541b39ed660fe33c346fa00893db8b64c
SHA18b84df9e45ce6bbb30cb4fdda96cc505059a2cf5
SHA256cf68147cb6f1d00f50cd767d6e7f18a885089bf0477eaa303b3f7bb3efc886e9
SHA512e16a400384c2b859e370974f472a0d44effcabc72ec2c03e7fc2160308aefee928c3bbc3a812c65a4155026607323bb75316fb92d7177b4d4b709f0a7e48ca32
-
Filesize
211B
MD5a64afd09e9ba88dca938e67aa4fd08e1
SHA1328fc42c946e603cecf25c247ecf791d83a241e5
SHA256b51f1c9ea38f7edb6620b26a52092f2f7e3448b284fafa40cc9d9369a41dc119
SHA5128a7761bf668ca040d4ced00effcc891f204e0cef96936784251c46351bacfa426d91dd8c5736d35f87d1db8fedbe1188eac92082d92f8afa4e00afd9351ff88a
-
Filesize
54B
MD5e063225b21707bd2d33b82a80d6ce6e6
SHA15ed3df211dd5dec270253d50015a6fd76327dd40
SHA256e9c0e95c2ad32c0d5bdd3d31c3c60baee5a1f9d4fb575b8cb5557feaf8e067d0
SHA5124fb9714be5daa59545b2e476534d929923c571ca7a4a35b5a21d5ea4616ed093ab38b68ef50b20000e95a07567c2b032a466081ea2ec7270dd75c9c6b951f0bd
-
Filesize
75KB
MD5b1488f690c3c040ed55319c7984cb6cb
SHA11a1e939efcda411ab7c03d1e20a18147ab614ebc
SHA256bae897ba53659ac7cb0c8a62003296dfb54b1078d9c24abbfdc3eea1edf44121
SHA51221e58b5e7b858d43644e17679635b9d73b2974314dfb8255af84677f66c2dea771a71f6b3d229dc983e1e1e45e642de10399f44be42ffe806de9bca2a75cf694
-
Filesize
83KB
MD58c6e6dc4f224e20117ff59bdf8fe79bf
SHA19dc4b87c2a0762e8aa969c4ef6ebd52c52a4a5eb
SHA256ae57550d71ebf3957a2221f0b9cf58cfe8a119ef8f8ca4ab4c839aa3b3424867
SHA512519b7a62010b422135077c7900b3590a381d701c789ff9c4ad45d091ec1b657d29d61fb2037f4a5113a63e2b05fb3bad25e61d136dd54a4347059c6f5dab299e