fabd6308a61a5991c5da0945256ceee26cc88b5e839e41dc02444bdafe485667

Analysis

max time kernel
135s
max time network
145s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/02/2025, 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fabd6308a61a5991c5da0945256ceee26cc88b5e839e41dc02444bdafe485667.elf
Size

135KB
MD5

bae707d3b1c351126c597d6758a4cffe
SHA1

96bd39a7e0b1f08c29a8c739af86a371b54e22a3
SHA256

fabd6308a61a5991c5da0945256ceee26cc88b5e839e41dc02444bdafe485667
SHA512

1dfe52fef9d30f628c4e7a9ab4480ad78a102bf0251f543095823023330d58def3ba7c9f372f5a195f563bebed9b8921050f23dd9a932a5b4da5142d8a2e962a
SSDEEP

3072:EHHyPnuTxmxpjcVhyofAWuvm5ReFfgK4iOtQlQ+135hwP/TJo1m6QNdNpHOe:wHyBvgwEtQlQC35hwP/Ti1m6QNdLHOe

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes Audit logs 1 TTPs 1 IoCs

Deletes logs related to the Linux Audit framework.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/audit/audit.log	rm

Deletes itself 1 IoCs

pid	Process
668	fabd6308a61a5991c5da0945256ceee26cc88b5e839e41dc02444bdafe485667.elf

Deletes system logs 1 TTPs 2 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/messages	rm
File deleted	/var/log/syslog	rm

Flushes firewall rules 1 TTPs 9 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
734	systemctl
734	systemctl
731	iptables
732	iptables
734	systemctl
734	systemctl
734	systemctl
699	iptables
734	systemctl

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/resolv.conf	fabd6308a61a5991c5da0945256ceee26cc88b5e839e41dc02444bdafe485667.elf

Deletes log files 1 TTPs 29 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/installer/cdebconf/templates.dat	rm
File deleted	/var/log/faillog	rm
File deleted	/var/log/apt/history.log	rm
File deleted	/var/log/installer/hardware-summary	rm
File deleted	/var/log/exim4	rm
File deleted	/var/log/auth.log	rm
File deleted	/var/log/audit	rm
File deleted	/var/log/installer/syslog	rm
File deleted	/var/log/installer/partman	rm
File deleted	/var/log/daemon.log	rm
File deleted	/var/log/btmp	rm
File deleted	/var/log/installer/cdebconf/questions.dat	rm
File deleted	/var/log/apt/term.log	rm
File deleted	/var/log/installer/lsb-release	rm
File deleted	/var/log/installer/status	rm
File deleted	/var/log/installer	rm
File deleted	/var/log/user.log	rm
File deleted	/var/log/lastlog	rm
File deleted	/var/log/apt/eipp.log.xz	rm
File deleted	/var/log/debug	rm
File deleted	/var/log/exim4/mainlog	rm
File deleted	/var/log/fontconfig.log	rm
File deleted	/var/log/wtmp	rm
File deleted	/var/log/installer/cdebconf	rm
File deleted	/var/log/kern.log	rm
File deleted	/var/log/alternatives.log	rm
File deleted	/var/log/wtmp	rm
File deleted	/var/log/dpkg.log	rm
File deleted	/var/log/apt	rm

Enumerates running processes
Discovers information about currently running processes on the system

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	fabd6308a61a5991c5da0945256ceee26cc88b5e839e41dc02444bdafe485667.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	kucescqfmqakouku	668	fabd6308a61a5991c5da0945256ceee26cc88b5e839e41dc02444bdafe485667.elf

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	fabd6308a61a5991c5da0945256ceee26cc88b5e839e41dc02444bdafe485667.elf

Enumerates kernel/hardware configuration 1 TTPs 30 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/314/status	pkill
File opened for reading	/proc/107/cmdline	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/104/status	pkill
File opened for reading	/proc/621/cmdline	pkill
File opened for reading	/proc/666/status	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/671/status	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/139/cmdline	pkill
File opened for reading	/proc/661/cmdline	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/75/cmdline	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/666/status	pkill
File opened for reading	/proc/6/cmdline	pkill
File opened for reading	/proc/447/cmdline	pkill
File opened for reading	/proc/671/cmdline	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/446/cmdline	pkill
File opened for reading	/proc/665/cmdline	pkill
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/165/status	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/305/cmdline	pkill
File opened for reading	/proc/447/status	pkill
File opened for reading	/proc/661/status	pkill
File opened for reading	/proc/666/status	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/282/status	pkill
File opened for reading	/proc/305/cmdline	pkill
File opened for reading	/proc/418/cmdline	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/106/status	pkill
File opened for reading	/proc/142/status	pkill
File opened for reading	/proc/691/status	pkill
File opened for reading	/proc/303/cmdline	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/660/status	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/142/status	pkill
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/344/cmdline	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/218/status	pkill
File opened for reading	/proc/661/status	pkill
File opened for reading	/proc/280/status	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/284/cmdline	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
698	sh
708	sh
709	service
730	sh

/tmp/fabd6308a61a5991c5da0945256ceee26cc88b5e839e41dc02444bdafe485667.elf
/tmp/fabd6308a61a5991c5da0945256ceee26cc88b5e839e41dc02444bdafe485667.elf
1⤵
- Deletes itself
- Writes DNS configuration
- Reads system routing table
- Changes its process name
- Reads system network configuration
PID:668
- /bin/sh
  sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"
  2⤵
  PID:672
- - /bin/rm
    rm -rf /tmp/systemd-private-8ac9b20eda93434480f68b279ed4afad-systemd-timedated.service-Ulhni4 /var/backups /var/cache /var/lib /var/local /var/lock /var/log /var/mail /var/opt /var/run /var/spool /var/tmp /var/run/atd.pid /var/run/auditd.pid /var/run/console-setup /var/run/crond.pid /var/run/crond.reboot /var/run/dbus /var/run/dhclient.eth0.pid /var/run/exim4 /var/run/initctl /var/run/initramfs /var/run/lock /var/run/log /var/run/motd.dynamic /var/run/mount /var/run/network /var/run/rsyslogd.pid /var/run/sendsigs.omit.d /var/run/shm /var/run/sshd /var/run/sshd.pid /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/user /var/run/utmp /var/tmp/systemd-private-8ac9b20eda93434480f68b279ed4afad-systemd-timedated.service-eKSOTR
    3⤵
    - Deletes Audit logs
    - Deletes system logs
    - Deletes log files
    PID:675
- /bin/sh
  sh -c "rm -rf /var/log/wtmp"
  2⤵
  PID:692
- - /bin/rm
    rm -rf /var/log/wtmp
    3⤵
    - Deletes log files
    PID:693
- /bin/sh
  sh -c "rm -rf /tmp/*"
  2⤵
  PID:694
- - /bin/rm
    rm -rf "/tmp/*"
    3⤵
    PID:695
- /bin/sh
  sh -c "rm -rf /bin/netstat"
  2⤵
  PID:696
- - /bin/rm
    rm -rf /bin/netstat
    3⤵
    PID:697
- /bin/sh
  sh -c "iptables -F"
  2⤵
  - System Network Configuration Discovery
  PID:698
- - /sbin/iptables
    iptables -F
    3⤵
    - Flushes firewall rules
    PID:699
- /bin/sh
  sh -c "pkill -9 busybox"
  2⤵
  PID:702
- - /usr/bin/pkill
    pkill -9 busybox
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:703
- /bin/sh
  sh -c "pkill -9 perl"
  2⤵
  PID:704
- - /usr/bin/pkill
    pkill -9 perl
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:705
- /bin/sh
  sh -c "pkill -9 python"
  2⤵
  PID:706
- - /usr/bin/pkill
    pkill -9 python
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:707
- /bin/sh
  sh -c "service iptables stop"
  2⤵
  - System Network Configuration Discovery
  PID:708
- - /usr/sbin/service
    service iptables stop
    3⤵
    - System Network Configuration Discovery
    PID:709
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:710
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:711
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Enumerates kernel/hardware configuration
      PID:712
  - - /bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Enumerates kernel/hardware configuration
      PID:714
  - - /bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:715
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:716
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:717
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:718
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:719
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:720
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:721
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:722
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:723
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:724
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:725
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:726
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:729
- - /usr/local/sbin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:709
- - /usr/local/bin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:709
- - /usr/sbin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:709
- - /usr/bin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:709
- - /sbin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:709
- - /bin/systemctl
    systemctl stop iptables.service
    3⤵
    - Enumerates kernel/hardware configuration
    PID:709
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:730
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    - Flushes firewall rules
    PID:731
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    - Flushes firewall rules
    PID:732
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:733
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:734
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:735
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:736
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Enumerates kernel/hardware configuration
      PID:737
  - - /bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      Reads runtime system information
      PID:740
  - - /bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Enumerates kernel/hardware configuration
      PID:739
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:741
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:742
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:743
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:744
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:745
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:746
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:747
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:751
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:752
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:753
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:754
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:755
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:734
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:734
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:734
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:734
- - /sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:734
- - /bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:734
- /bin/sh
  sh -c "rm -rf ~/.bash_history"
  2⤵
  PID:758
- - /bin/rm
    rm -rf "~/.bash_history"
    3⤵
    PID:759
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:761