1d129b9c9a6c5aad8a22a3f7cbf45da61c7eb9150f160f495bd15a0f2cd1d8af

General

Target
mipsel.elf
Size 6.3MB
Sample261013-cvtkrsdz21
SHA256 1d129b9c9a6c5aad8a22a3f7cbf45da61c7eb9150f160f495bd15a0f2cd1d8af
MD5 83b149cb0f3f959190d3eedac07d8fe3
SHA1 69c4377c021148673c62cb60c1b7e6a69969118b
SHA512 bf68ad508cd6a7e54955e24bdca3eac9cf4143e472a2219f2e74a8b6d13bde37bede4ebf8735a11dc5b9b90c0f862ad82a8ca8e7127c17e97e85c8f9dfaabd28
SSDEEP 49152:ghku38yKfPx1kp4iPkQZHRIXjBUbIuWt9dxawk5Eb:afPkCLWjhWEb
TLSH
T17366F815AD842BEAC46C4B7544FAC95A23B05D140AF14B7A66A4FFEDBC722347F0788C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.Hnm3l1	crontab
File opened for modification	/etc/cron.d/system-update	mipsel.elf

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/system-update	mipsel.elf

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/bot-update.service	mipsel.elf

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	mipsel.elf
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	mipsel.elf

Reads runtime system information 9 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/mountinfo	mipsel.elf
File opened for reading	/proc/self/cgroup	mipsel.elf
File opened for reading	/proc/self/status	mipsel.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
805	mipsel.elf

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.cron	mipsel.elf

/tmp/mipsel.elf
/tmp/mipsel.elf
1⤵
- Creates/modifies Cron job
- Modifies init.d
- Modifies systemd
- Enumerates kernel/hardware configuration
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:805
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:832
- /usr/bin/crontab
  crontab /tmp/.cron
  2⤵
  - Creates/modifies Cron job
  PID:834
- /usr/bin/systemctl
  systemctl enable bot-update.service
  2⤵
  - Reads runtime system information
  PID:838
- /usr/bin/systemctl
  systemctl start bot-update.service
  2⤵
  - Reads runtime system information
  PID:866
- /usr/sbin/update-rc.d
  update-rc.d system-update defaults
  2⤵
  PID:873
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:890
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:890
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:890
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads runtime system information
    PID:890
- /usr/sbin/service
  service system-update start
  2⤵
  PID:922
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:923
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:924
- - /usr/bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    - Reads runtime system information
    PID:927
- - /usr/bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Reads runtime system information
    PID:926
- /usr/local/sbin/systemctl
  systemctl start system-update.service
  2⤵
  PID:922
- /usr/local/bin/systemctl
  systemctl start system-update.service
  2⤵
  PID:922
- /usr/sbin/systemctl
  systemctl start system-update.service
  2⤵
  PID:922
- /usr/bin/systemctl
  systemctl start system-update.service
  2⤵
  - Reads runtime system information
  PID:922
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Persistence

Boot or Logon Autostart Execution

2

T1547

XDG Autostart Entries

1

T1547.013

Boot or Logon Initialization Scripts

1

T1037

RC Scripts

1

T1037.004

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

XDG Autostart Entries

1

T1547.013

Boot or Logon Initialization Scripts

1

T1037

RC Scripts

1

T1037.004

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

system-update

Path /etc/cron.d/system-update
Size 95B
SHA256 c8e6c462f706ad0dc586447c3994987716f47dd1de7034f49114af9cbd124824
MD5 52009b396fb89c4e762927c40f64c200
SHA1 4cbdc08d4953b436e469145fdf630efdf84af0c7
SHA512 497493376364c0acf94e2f6352ecbd7d7b7d4e195ad9c60bd76d7aeb51d4fd11b40f483d8cc583f264d9880cce2b4ee60494108d2885af80e4feb867320b6dad
TLSH
T129B00234E78AA7319155FCE40004295484A534542381781018CD90D1D115A92062AC69
MD5 SHA1 SHA512 TLSH

Submit Download

system-update

Path /etc/init.d/system-update
Size 219B
SHA256 477bf61f9e1fd395fed549ba499defb931b4d2ac08fd1995cae82aafe24ef466
MD5 aac68dc76250db4d89678f1bff8eb4ef
SHA1 f459b173e0a906028edb0bf41b869da5da08c94d
SHA512 d3ade0e7a62f3542688f256dba0b5c89867edda43234c23b33a5e5ae6c1e13655170f3a7c98bb01b3bcb9aa5320ea517562940b532286516529c9beab34496aa
TLSH
T18AD01251E255D6306F1B85FC970A326BC86025171621BC107FCE5BC7EF129635279A74
MD5 SHA1 SHA512 TLSH

Submit Download

bot-update.service

Path /etc/systemd/system/bot-update.service
Size 194B
SHA256 e2e271543855504eefcce8105ef01fb452f09f9949ab7fc13b51ff4596ffc63b
MD5 91a421186741476b94cd9ee8b0c978a9
SHA1 4efd57787991ea94a56f70d614ef3d5187f34125
SHA512 533252e22e1ab159a1a2068f981b1737434fef9a4cf5754e0efc376d91a5f83a9041b8d9f45d9988c0d9c0ab63da45158b95a3a68c49f50099cc592fe268876b
TLSH
T137C0222297A1A0B1C90A3CB68EA26B108E2011442B8EF0200FC11085C0D09470234DBD
MD5 SHA1 SHA512 TLSH

Submit Download

.cron

Path /tmp/.cron
Size 86B
SHA256 b8d421c20e7f52ffde0c79f50ac013cfede505db85f78ea4b0a3ab25262087c5
MD5 03c5fcb50a1afa1a83619d11b61b2e1d
SHA1 36bc7d90a6ff717036560d75f062a248322b1f35
SHA512 999b08968fce88bedec537cf7127409841d09799bc3e2c4103c44bc15d2a012baa0ddb2c969a4fb26ffad77ad7662eb9c71adecc76e5deeba3853dbb1cbc53d5
TLSH
T144A00234D7CEE671D1157CF410043D1484B43450338165001CCD50D1D115FA20739C75
MD5 SHA1 SHA512 TLSH

Submit Download

systemd-update

Path /usr/lib/systemd/systemd-update
Size 6.3MB
SHA256 1d129b9c9a6c5aad8a22a3f7cbf45da61c7eb9150f160f495bd15a0f2cd1d8af
MD5 83b149cb0f3f959190d3eedac07d8fe3
SHA1 69c4377c021148673c62cb60c1b7e6a69969118b
SHA512 bf68ad508cd6a7e54955e24bdca3eac9cf4143e472a2219f2e74a8b6d13bde37bede4ebf8735a11dc5b9b90c0f862ad82a8ca8e7127c17e97e85c8f9dfaabd28
SSDEEP 49152:ghku38yKfPx1kp4iPkQZHRIXjBUbIuWt9dxawk5Eb:afPkCLWjhWEb
TLSH
T17366F815AD842BEAC46C4B7544FAC95A23B05D140AF14B7A66A4FFEDBC722347F0788C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.Hnm3l1

Path /var/spool/cron/crontabs/tmp.Hnm3l1
Size 270B
SHA256 4a612e5e671d4c0180a1c43740fae56630307f750fc177b145c055945eb86225
MD5 73e90584dfc298017c25a4abd69cde54
SHA1 883cc50b353e01a243709592c01d7ad149d7ef17
SHA512 4c76c73504cb76543b7f85e408470531384af9bf51d9ffcb2744d1a38bd54ffcc56f64297f56317d0787c3e7e1a404d22a9cbc913bca44f3cd2c563a6a258d43
TLSH
T1C5D0953CFF50F93195112BC810051C2CCCD0B074614DED00D4CE10E0C217B5A2B74CB1
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads