Analysis

  • max time kernel
    149s
  • max time network
    162s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    17/02/2025, 18:23

General

  • Target

    Linux-Malware-Samples-main/0afd9f52ddada582d5f907e0a8620cbdbe74ea31cf775987a5675226c1b228c2

  • Size

    222KB

  • MD5

    6d3143576c48c1dae88ca48742431f6e

  • SHA1

    9d54f990c69390405c2183ddb86023d9c7a55845

  • SHA256

    0afd9f52ddada582d5f907e0a8620cbdbe74ea31cf775987a5675226c1b228c2

  • SHA512

    0951df9dd84e3df1dfd99a60a17ce6b49a5d2b69266666d99989281a6bd51c03bff0af8ce21c78a798407c7f139a198202979e6338eefb47dc7b73db1b8eba4b

  • SSDEEP

    6144:yhMZEEwR4uTMfbjVphafsTZTUYZw9mAJpDoXICgShlVtEANU:yhM8TU1ph4mwLDoXICgShlVtlNU

Malware Config

Signatures

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

  • Writes file to system bin folder 2 IoCs
  • Reads process memory 1 TTPs 1 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

  • Changes its process name 1 IoCs
  • Reads system network configuration 1 TTPs 2 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/Linux-Malware-Samples-main/0afd9f52ddada582d5f907e0a8620cbdbe74ea31cf775987a5675226c1b228c2
    /tmp/Linux-Malware-Samples-main/0afd9f52ddada582d5f907e0a8620cbdbe74ea31cf775987a5675226c1b228c2
    1⤵
    • Modifies Watchdog functionality
    • Reads system routing table
    • Writes file to system bin folder
    • Reads process memory
    • Changes its process name
    • Reads system network configuration
    • Reads runtime system information
    PID:1499
    • /bin/sh
      sh -c "/bin/busybox wget 2>&1"
      2⤵
        PID:1518
        • /bin/busybox
          /bin/busybox wget
          3⤵
            PID:1519
        • /bin/sh
          sh -c "wget https://urlhaus.abuse.ch/downloads/text_online/ -q"
          2⤵
            PID:1520
            • /usr/bin/wget
              wget https://urlhaus.abuse.ch/downloads/text_online/ -q
              3⤵
              • Writes file to tmp directory
              PID:1521
          • /bin/sh
            sh -c "/bin/busybox wget 2>&1"
            2⤵
              PID:1531
              • /bin/busybox
                /bin/busybox wget
                3⤵
                  PID:1532
              • /bin/sh
                sh -c "wget https://urlhaus.abuse.ch/downloads/text_online/ -q"
                2⤵
                  PID:1533
                  • /usr/bin/wget
                    wget https://urlhaus.abuse.ch/downloads/text_online/ -q
                    3⤵
                    • Writes file to tmp directory
                    PID:1534

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • /root/.wget-hsts

                Filesize

                171B

                MD5

                58f64bd4135dc6c0d42a5870d2d7b134

                SHA1

                154e7ec9aba811fc97e7fba884e454d62cefe59a

                SHA256

                ba7f9728df6dbd114d5601f0d7a96af9e8746232efa6f383384d6d9576890f60

                SHA512

                beedf1b35d16cfa24ffa8670b833267c7925e32937127a5a2eab7c532c39232bc10b62f324d93bab86e4457959f157c0a40d1e19c68dc372bcc9966cb0f39dc8

              • /root/.wget-hsts

                Filesize

                171B

                MD5

                c4bc3f6f430671814348f524d1646a92

                SHA1

                a7cf5a1dee9da784f77baf0b3f177bd352590a30

                SHA256

                608308d6ed86c83e0fbd7608cf6548572abec5e293d5e48fe1759b8a261c2500

                SHA512

                f5c95b87e5f83cf7fa1e05663bf2747cd5422af677779259079f7d02c0c0223e4e23283c80f5313a004e794ec213c6362bc78a9504727e20081e5fb1550b009c

              • /tmp/Linux-Malware-Samples-main/index.html

                Filesize

                418KB

                MD5

                b2289def5ed0d3810f212f4612188754

                SHA1

                038cd0f761f3508044f893e42dd6b33934ce3140

                SHA256

                5cced7e0e333d968ea5063d17492cb61bd508caa7a5c225bc501c4f6e8794dbb

                SHA512

                75238bda5b4e6ca1afb38c6886c7c47519cfa665effb9b69f4fe50419da102d58124010796b4ae3d05ec73a1028b973aeda2e4466491e69f90a4d405d1cc2353