Resubmissions

11/04/2025, 21:31

250411-1cz7lazpx8 10

Analysis

  • max time kernel
    29s
  • max time network
    3s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20250307-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20250307-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    11/04/2025, 21:31

General

  • Target

    The-MALWARE-Repo-master/Botnets/FritzFrog/7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd

  • Size

    8.7MB

  • MD5

    b2e0eede7b18253dccd0d44ebb5db85a

  • SHA1

    ee5db9590090efd5549e1c17ec1ee956ef1ed3d1

  • SHA256

    7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd

  • SHA512

    5608fe7bde5072de7c98bacfe7beb928e6073be87c0fbccd8075c808d9a7c642abe254f6eb620d627f5324e35821fc9b41a31970264abcc472adfbe2c214a9fe

  • SSDEEP

    98304:zbc+G4RTwJg0GTvmF3D4cQ1XmkPF0ihOehaOE3Ok7Xk:zbc+G4RTwJGOzfQYkPGihOekj

Malware Config

Signatures

  • Adds new SSH keys 1 TTPs 1 IoCs

    Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

  • Deletes itself 1 IoCs
  • Deletes log files 1 TTPs 1 IoCs

    Deletes log files on the system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Virtualization/Sandbox Evasion: Time Based Evasion 1 TTPs 3 IoCs

    Adversaries may detect and evade virtualized environments and sandboxes.

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
    /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
    1⤵
    • Adds new SSH keys
    • Deletes itself
    • Deletes log files
    • Reads runtime system information
    • Writes file to tmp directory
    PID:2550
    • /usr/bin/uname
      uname -a
      2⤵
        PID:2568
      • /usr/bin/cat
        cat /proc/cpuinfo
        2⤵
        • Checks CPU configuration
        PID:2569
      • /usr/bin/cat
        cat /etc/issue
        2⤵
          PID:2571
        • /usr/bin/free
          free -m
          2⤵
            PID:2572
          • /usr/bin/uptime
            uptime
            2⤵
            • Virtualization/Sandbox Evasion: Time Based Evasion
            PID:2573
          • /usr/bin/journalctl
            journalctl -S "@0" -u sshd
            2⤵
              PID:2574
            • /usr/bin/cat
              cat "/var/log/auth*"
              2⤵
                PID:2576
              • /usr/bin/zcat
                zcat "/var/log/auth*"
                2⤵
                  PID:2577
                • /usr/local/sbin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                  • System Network Configuration Discovery
                  PID:2577
                • /usr/local/bin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                  • System Network Configuration Discovery
                  PID:2577
                • /usr/sbin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                  • System Network Configuration Discovery
                  PID:2577
                • /usr/bin/gzip
                  gzip -cd "/var/log/auth*"
                  2⤵
                  • System Network Configuration Discovery
                  PID:2577
                • /usr/bin/free
                  free -m
                  2⤵
                    PID:2597
                  • /usr/bin/uptime
                    uptime
                    2⤵
                    • Virtualization/Sandbox Evasion: Time Based Evasion
                    PID:2598
                  • /usr/bin/free
                    free -m
                    2⤵
                      PID:2599
                    • /usr/bin/uptime
                      uptime
                      2⤵
                      • Virtualization/Sandbox Evasion: Time Based Evasion
                      PID:2600

                  Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • /tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/nc

                    Filesize

                    8.7MB

                    MD5

                    b2e0eede7b18253dccd0d44ebb5db85a

                    SHA1

                    ee5db9590090efd5549e1c17ec1ee956ef1ed3d1

                    SHA256

                    7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd

                    SHA512

                    5608fe7bde5072de7c98bacfe7beb928e6073be87c0fbccd8075c808d9a7c642abe254f6eb620d627f5324e35821fc9b41a31970264abcc472adfbe2c214a9fe