Overview

overview

10

Static

static

10

rHGF6UobDr...j02lX5

ubuntu-22.04-amd64

7

Resubmissions

25/03/2025, 12:33

250325-prj85swths 10

25/03/2025, 12:32

250325-pqvcqazkz3 10

07/02/2025, 09:45

250207-lrhtjaykek 10

Analysis

  • max time kernel
    119s
  • max time network
    69s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20250307-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20250307-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    25/03/2025, 12:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    rHGF6UobDrEAw59FT3LPxJNMVzBlj02lX5

  • Size

    112KB

  • MD5

    05d7857dcead18bbd86d2935f591873c

  • SHA1

    34d18f41ef35f93d5364ce3e24d74730a4e91985

  • SHA256

    2cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70

  • SHA512

    d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e

  • SSDEEP

    3072:o0pHqiUxCoypP1Xyukbt56UFQ71SMSmUHM5RmNtbm9c:REOtiukxc3SmUHM5Rm/bm9c

Score
7/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Renames itself 1 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/rHGF6UobDrEAw59FT3LPxJNMVzBlj02lX5
    /tmp/rHGF6UobDrEAw59FT3LPxJNMVzBlj02lX5 bcdedit /set shutdown /r /f /t 2
    1⤵
    • Renames itself
    • Reads runtime system information
    PID:1556
    • /bin/sh
      sh -c "crontab -l"
      2⤵
        PID:1558
        • /usr/bin/crontab
          crontab -l
          3⤵
            PID:1559
        • /bin/sh
          sh -c "crontab -"
          2⤵
            PID:1560
            • /usr/bin/crontab
              crontab -
              3⤵
              • Creates/modifies Cron job
              PID:1561

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /var/spool/cron/crontabs/tmp.jgdgov
          Filesize

          210B

          MD5

          456e7180a6467624180adedf6db4b453

          SHA1

          3c10a0f7a7b1f631291ff2287cae9833532dd143

          SHA256

          0885bea2b1140de876f2e37d223f308038d28168e828d375e0c4e86124154a01

          SHA512

          3b33b254431328b7f6679cdd62af9a139ca2d44c8bd34e6724cd9c901b024857f791c214e61a70686b338c3083db97b3e02d148b5055608b2c20def7385178b3

          Download Submit