Overview

overview

8

Static

static

1

2024-12-27...ockbit

ubuntu-22.04-amd64

8

Resubmissions

28/03/2025, 06:04

250328-gsw1bsswcx 8

27/12/2024, 01:42

241227-b4yqeaylan 8

Analysis

  • max time kernel
    3s
  • max time network
    128s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20250307-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20250307-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    28/03/2025, 06:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-27_3589e9b7abdf6e89063977847351173b_lockbit

  • Size

    89KB

  • MD5

    3589e9b7abdf6e89063977847351173b

  • SHA1

    a95652971f89587cf5f717c99c894ca2122101a0

  • SHA256

    f9b34255399925fcae10f34e78275446f9a90263afd3b825e889d5e631a74d0e

  • SHA512

    90550b2e8e9ddabbccf5d35907d40282db65876da1efb6e0e864ec8e8e8e1a92f2da0082b64d286f8c05087f417caa2470da1bc89f8ad55e8bd168305c7e2155

  • SSDEEP

    1536:h23bmHSlAhb6eo1xrac08UGNnPnEsT9VxU+tqRAsemhgYBzvI:4rmHSlAhbx+K8UUnPEsBVxDtqR19gAI

Score
8/10
antivmcredential_accessdiscoveryspywarestealer

Malware Config

Signatures

  • Traces remote process 1 IoCs
  • Reads user data of web browsers 3 TTPs 28 IoCs

    Reads stored browser data which can include saved credentials.

    spywarestealercredential_accessdiscovery
  • Reads AppArmor ptrace settings 1 TTPs 1 IoCs

    Discovery of allowed ptrace capabilities by AppArmor.

    discovery
  • Checks system information (zLinux) 1 TTPs 1 IoCs

    Check system information on IBM zSystems which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads hardware information 1 TTPs 1 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Reads network interface configuration 2 TTPs 12 IoCs

    Fetches information about one or more active network interfaces.

    discovery
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 64 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/2024-12-27_3589e9b7abdf6e89063977847351173b_lockbit
    /tmp/2024-12-27_3589e9b7abdf6e89063977847351173b_lockbit
    1⤵
    • Traces remote process
    • Reads user data of web browsers
    • Reads AppArmor ptrace settings
    • Reads hardware information
    • Reads network interface configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    PID:1572
    • /bin/sh
      sh -c "vim-cmd hostsvc/hostsummary | grep cpuModel | cut -d '\"' -f2"
      2⤵
        PID:1573
        • /usr/bin/grep
          grep cpuModel
          3⤵
            PID:1575
          • /usr/bin/cut
            cut -d "\"" -f2
            3⤵
              PID:1576
          • /bin/sh
            sh -c "lscpu | grep \"Model name\" | cut -d ':' -f2"
            2⤵
              PID:1577
              • /usr/bin/cut
                cut -d : -f2
                3⤵
                  PID:1580
                • /usr/bin/grep
                  grep "Model name"
                  3⤵
                    PID:1579
                  • /usr/bin/lscpu
                    lscpu
                    3⤵
                    • Checks system information (zLinux)
                    • Checks CPU configuration
                    • Reads CPU attributes
                    PID:1578
                • /bin/sh
                  sh -c "esxcli storage filesystem list | tail -n +3"
                  2⤵
                    PID:1581
                    • /usr/bin/tail
                      tail -n +3
                      3⤵
                        PID:1583
                    • /bin/sh
                      sh -c "lsblk -io KNAME,TYPE,SIZE,MODEL | tail -n +2"
                      2⤵
                        PID:1584
                        • /usr/bin/tail
                          tail -n +2
                          3⤵
                            PID:1586
                          • /usr/bin/lsblk
                            lsblk -io "KNAME,TYPE,SIZE,MODEL"
                            3⤵
                              PID:1585
                          • /bin/sh
                            sh -c "uname -a"
                            2⤵
                              PID:1587
                              • /usr/bin/uname
                                uname -a
                                3⤵
                                  PID:1588
                              • /bin/sh
                                sh -c "vmware -v"
                                2⤵
                                  PID:1589
                                • /bin/sh
                                  sh -c "ls -alR /vmfs/"
                                  2⤵
                                    PID:1593
                                    • /usr/bin/ls
                                      ls -alR /vmfs/
                                      3⤵
                                        PID:1594
                                    • /bin/sh
                                      sh -c "ps auxf"
                                      2⤵
                                        PID:1595
                                        • /usr/bin/ps
                                          ps auxf
                                          3⤵
                                          • Reads CPU attributes
                                          • Reads runtime system information
                                          PID:1596

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads