8fd2ef68325614ca08a318ee89a9747fcc680b5802fe64b3439e25fb987d375f

Analysis

max time kernel
117s
max time network
131s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
23/02/2025, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fd2ef68325614ca08a318ee89a9747fcc680b5802fe64b3439e25fb987d375f.elf
Size

111KB
MD5

1d94761620e2fb40d084f3b1d8029a67
SHA1

80e691debcf5981bbe1a8d27b848fe581453299f
SHA256

8fd2ef68325614ca08a318ee89a9747fcc680b5802fe64b3439e25fb987d375f
SHA512

9db49a44d4d32c6bc1e8ed76f5de5e852e97d5b7495eb06c1ce40ac50ac19c29baa525685914d414c388d3c397233ea894abd1d3508d03b1fbbb564d9497836e
SSDEEP

3072:p61RPKvVjRWDTEEvQVzCdUC/EWi1sB5htYozmB80CjKaIU:p61RPKvVjRWDTEzb1sB5ht/mB80C+aIU

Score

7^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Deletes itself 1 IoCs

pid
1588

Deletes journal logs 1 TTPs 3 IoCs

Deletes systemd journal logs. Likely to evade detection.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/journal/f2de92a803c744e586bd87567a26b68a/system@5d9f2360db104821ae6d0ca2a2cf5265-0000000000000001-00061aa41e3a5cd0.journal	rm
File deleted	/var/log/journal/f2de92a803c744e586bd87567a26b68a	rm
File deleted	/var/log/journal/f2de92a803c744e586bd87567a26b68a/system.journal	rm

Flushes firewall rules 1 TTPs 6 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
1634	iptables
1635	iptables
1637	systemctl
1637	systemctl
1637	systemctl
1637	systemctl

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc
File opened for modification	/etc/resolv.conf

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
1592	rm

Deletes log files 1 TTPs 62 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/installer/curtin-install.log	rm
File deleted	/var/log/cups	rm
File deleted	/var/log/unattended-upgrades/unattended-upgrades.log	rm
File deleted	/var/log/journal	rm
File deleted	/var/log/lastlog	rm
File deleted	/var/log/btmp	rm
File deleted	/var/log/installer/subiquity-server-info.log	rm
File deleted	/var/log/sssd	rm
File deleted	/var/log/installer/subiquity-client-info.log.1108	rm
File deleted	/var/log/installer/cloud-init-output.log	rm
File deleted	/var/log/dpkg.log	rm
File deleted	/var/log/unattended-upgrades/unattended-upgrades-shutdown.log	rm
File deleted	/var/log/unattended-upgrades/unattended-upgrades-dpkg.log	rm
File deleted	/var/log/speech-dispatcher	rm
File deleted	/var/log/alternatives.log	rm
File deleted	/var/log/cups/access_log	rm
File deleted	/var/log/ubuntu-advantage.log	rm
File deleted	/var/log/installer/subiquity-client-info.log	rm
File deleted	/var/log/installer/subiquity-client-debug.log.1108	rm
File deleted	/var/log/installer/curtin-install/subiquity-extract.conf	rm
File deleted	/var/log/wtmp	rm
File deleted	/var/log/Xorg.0.log.old	rm
File deleted	/var/log/installer/subiquity-client-debug.log	rm
File deleted	/var/log/installer/cloud-init.log	rm
File deleted	/var/log/gdm3	rm
File deleted	/var/log/hp	rm
File deleted	/var/log/installer/autoinstall-user-data	rm
File deleted	/var/log/unattended-upgrades	rm
File deleted	/var/log/private	rm
File deleted	/var/log/apt	rm
File deleted	/var/log/installer/curtin-install/subiquity-partitioning.conf	rm
File deleted	/var/log/installer	rm
File deleted	/var/log/apt/term.log	rm
File deleted	/var/log/apt/eipp.log.xz	rm
File deleted	/var/log/installer/subiquity-server-debug.log	rm
File deleted	/var/log/installer/curtin-install/subiquity-curthooks.conf	rm
File deleted	/var/log/installer/subiquity-client-debug.log.1883	rm
File deleted	/var/log/Xorg.0.log	rm
File deleted	/var/log/fontconfig.log	rm
File deleted	/var/log/cloud-init-output.log	rm
File deleted	/var/log/installer/device-map.json	rm
File deleted	/var/log/installer/subiquity-server-debug.log.1910	rm
File deleted	/var/log/installer/curtin-install/subiquity-initial.conf	rm
File deleted	/var/log/installer/curtin-install	rm
File deleted	/var/log/dist-upgrade	rm
File deleted	/var/log/installer/subiquity-server-info.log.1910	rm
File deleted	/var/log/installer/block/probe-data.json	rm
File deleted	/var/log/installer/block	rm
File deleted	/var/log/installer/media-info	rm
File deleted	/var/log/installer/subiquity-client-info.log.1883	rm
File deleted	/var/log/installer/subiquity-curtin-apt.conf	rm
File deleted	/var/log/bootstrap.log	rm
File deleted	/var/log/installer/casper-md5check.json	rm
File deleted	/var/log/apt/history.log	rm
File deleted	/var/log/installer/block/discover.log	rm
File deleted	/var/log/cloud-init.log	rm
File deleted	/var/log/openvpn	rm
File deleted	/var/log/wtmp	rm
File deleted	/var/log/installer/installer-journal.txt	rm
File deleted	/var/log/hp/tmp	rm
File deleted	/var/log/faillog	rm
File deleted	/var/log/gpu-manager.log	rm

Enumerates running processes
Discovers information about currently running processes on the system

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc
File opened for reading	/proc/net/route

Changes its process name 1 IoCs

description	pid
Changes the process name, possibly in an attempt to hide itself	1588

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc
File opened for reading	/proc/net/route

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/833/status	pkill
File opened for reading	/proc/833/cmdline	pkill
File opened for reading	/proc/446/status	pkill
File opened for reading	/proc/734/cmdline	pkill
File opened for reading	/proc/1296/status	pkill
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/588/status	pkill
File opened for reading	/proc/217/cmdline	pkill
File opened for reading	/proc/212/status	pkill
File opened for reading	/proc/215/cmdline	pkill
File opened for reading	/proc/223/status	pkill
File opened for reading	/proc/1159/cmdline	pkill
File opened for reading	/proc/78/cmdline	pkill
File opened for reading	/proc/1159/cmdline	pkill
File opened for reading	/proc/1167/cmdline	pkill
File opened for reading	/proc/522/cmdline	pkill
File opened for reading	/proc/1402/status	pkill
File opened for reading	/proc/631/status	pkill
File opened for reading	/proc/777/status	pkill
File opened for reading	/proc/1184/cmdline	pkill
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/669/cmdline	pkill
File opened for reading	/proc/413/cmdline	pkill
File opened for reading	/proc/92/status	pkill
File opened for reading	/proc/590/status	pkill
File opened for reading	/proc/754/status	pkill
File opened for reading	/proc/1329/status	pkill
File opened for reading	/proc/1338/cmdline	pkill
File opened for reading	/proc/75/cmdline	pkill
File opened for reading	/proc/738/status	pkill
File opened for reading	/proc/1138/cmdline	pkill
File opened for reading	/proc/1299/status	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/217/status	pkill
File opened for reading	/proc/91/status	pkill
File opened for reading	/proc/92/cmdline	pkill
File opened for reading	/proc/218/status	pkill
File opened for reading	/proc/413/status	pkill
File opened for reading	/proc/1299/cmdline	pkill
File opened for reading	/proc/212/cmdline	pkill
File opened for reading	/proc/310/cmdline	pkill
File opened for reading	/proc/1041/cmdline	pkill
File opened for reading	/proc/590/status	pkill
File opened for reading	/proc/754/status	pkill
File opened for reading	/proc/1603/cmdline	pkill
File opened for reading	/proc/85/cmdline	pkill
File opened for reading	/proc/1051/status	pkill
File opened for reading	/proc/1555/status	pkill
File opened for reading	/proc/693/cmdline	pkill
File opened for reading	/proc/1321/status	pkill
File opened for reading	/proc/99/cmdline	pkill
File opened for reading	/proc/1156/cmdline	pkill
File opened for reading	/proc/101/cmdline	pkill
File opened for reading	/proc/772/cmdline	pkill
File opened for reading	/proc/1407/status	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/222/cmdline	pkill
File opened for reading	/proc/1111/status	pkill
File opened for reading	/proc/599/status	pkill
File opened for reading	/proc/1035/status	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/1193/cmdline	pkill

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1627	service

/usr/bin/rm
rm -rf /tmp/gdm3-config-err-ArPAci /tmp/snap-private-tmp /tmp/systemd-private-2038fc548ac4457a93fe76018504634e-ModemManager.service-Xu84ld /tmp/systemd-private-2038fc548ac4457a93fe76018504634e-colord.service-IR5QYa /tmp/systemd-private-2038fc548ac4457a93fe76018504634e-power-profiles-daemon.service-ZQVR0t /tmp/systemd-private-2038fc548ac4457a93fe76018504634e-switcheroo-control.service-LwhbiL /tmp/systemd-private-2038fc548ac4457a93fe76018504634e-systemd-logind.service-UbNSiR /tmp/systemd-private-2038fc548ac4457a93fe76018504634e-systemd-oomd.service-dHc5in /tmp/systemd-private-2038fc548ac4457a93fe76018504634e-systemd-resolved.service-e9IC3Z /tmp/systemd-private-2038fc548ac4457a93fe76018504634e-systemd-timedated.service-4hOdZL /tmp/systemd-private-2038fc548ac4457a93fe76018504634e-upower.service-Wqt6vd /var/backups /var/cache /var/crash /var/lib /var/local /var/lock /var/log /var/mail /var/metrics /var/opt /var/run /var/snap /var/spool /var/tmp /var/run/NetworkManager /var/run/acpid.pid /var/run/acpid.socket /var/run/agetty.reload /var/run/avahi-daemon /var/run/blkid /var/run/cloud-init /var/run/console-setup /var/run/credentials /var/run/crond.pid /var/run/crond.reboot /var/run/cryptsetup /var/run/cups /var/run/dbus /var/run/dmeventd-client /var/run/dmeventd-server /var/run/fsck /var/run/gdm3 /var/run/gdm3.pid /var/run/initctl /var/run/initramfs /var/run/lock /var/run/log /var/run/lvm /var/run/lxd-installer.socket /var/run/mount /var/run/multipath /var/run/multipathd.pid /var/run/openvpn /var/run/openvpn-client /var/run/openvpn-server /var/run/sendsigs.omit.d /var/run/shm /var/run/snapd-snap.socket /var/run/snapd.socket /var/run/speech-dispatcher /var/run/spice-vdagentd /var/run/sshd /var/run/sshd.pid /var/run/sudo /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/udisks2 /var/run/user /var/run/utmp /var/tmp/systemd-private-2038fc548ac4457a93fe76018504634e-ModemManager.service-Ew5VzY /var/tmp/systemd-private-2038fc548ac4457a93fe76018504634e-colord.service-Gkw8PN /var/tmp/systemd-private-2038fc548ac4457a93fe76018504634e-power-profiles-daemon.service-3QMFuY /var/tmp/systemd-private-2038fc548ac4457a93fe76018504634e-switcheroo-control.service-IORMK4 /var/tmp/systemd-private-2038fc548ac4457a93fe76018504634e-systemd-logind.service-ca7kYa /var/tmp/systemd-private-2038fc548ac4457a93fe76018504634e-systemd-oomd.service-rQbMdl /var/tmp/systemd-private-2038fc548ac4457a93fe76018504634e-systemd-resolved.service-kaBfVx /var/tmp/systemd-private-2038fc548ac4457a93fe76018504634e-systemd-timedated.service-W8NGCY /var/tmp/systemd-private-2038fc548ac4457a93fe76018504634e-upower.service-d1Rets
1⤵
- Deletes journal logs
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Deletes log files
PID:1592

/usr/bin/rm
rm -rf /var/log/wtmp
1⤵
- Deletes log files
PID:1614

/usr/bin/rm
rm -rf "/tmp/*"
1⤵
PID:1616

/usr/bin/rm
rm -rf /bin/netstat
1⤵
PID:1618

/usr/bin/pkill
pkill -9 busybox
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1621

/usr/bin/pkill
pkill -9 perl
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1623

/usr/bin/pkill
pkill -9 python
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1625

/usr/sbin/service
service iptables stop
1⤵
- System Network Configuration Discovery
PID:1627
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:1628
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:1629
- /usr/bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  PID:1632
- /usr/bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  PID:1631

/usr/local/sbin/systemctl
systemctl stop iptables.service
1⤵
PID:1627

/usr/local/bin/systemctl
systemctl stop iptables.service
1⤵
PID:1627

/usr/sbin/systemctl
systemctl stop iptables.service
1⤵
PID:1627

/usr/bin/systemctl
systemctl stop iptables.service
1⤵
PID:1627

/sbin/iptables
/sbin/iptables -F
1⤵
- Flushes firewall rules
PID:1634

/sbin/iptables
/sbin/iptables -X
1⤵
- Flushes firewall rules
PID:1635

/usr/sbin/service
service firewalld stop
1⤵
PID:1637
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:1638
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:1639
- /usr/bin/sed
  sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
  2⤵
  - Reads runtime system information
  PID:1642
- /usr/bin/systemctl
  systemctl list-unit-files --full "--type=socket"
  2⤵
  PID:1641