e0bd5e6d810e5316aca109bc7733e348c762ecd52ac4fec9d85b2b0a9efb9485

description	ioc	Process
File opened for modification	/etc/ld.so.preload	x86_64.elf

Deletes itself 1 IoCs

pid	Process
1496	x86_64.elf

Deletes journal logs 1 TTPs 2 IoCs

Deletes systemd journal logs. Likely to evade detection.

defense_evasion

Clear Linux or Mac System Logs

description	ioc	Process
File deleted	/var/log/journal/11c67417355f45d397f6be11f62e85a6/system@86c7b08fe52f47de94a74615ac3fb08d-0000000000000001-000651b655f5f45f.journal	journalctl
File deleted	/var/log/journal/11c67417355f45d397f6be11f62e85a6/[email protected]~	journalctl

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

execution persistence privilege_escalation

description	ioc	Process
File truncated	/var/log/syslog	x86_64.elf

Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs

Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/hosts	x86_64.elf

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Cron

description	ioc	Process
File opened for modification	/etc/cron.d/killer-helper	x86_64.elf
File opened for modification	/etc/cron.d/sys-network-helper	x86_64.elf

Deletes log files 1 TTPs 6 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

description	ioc	Process
File truncated	/var/log/faillog	x86_64.elf
File truncated	/var/log/kern.log	x86_64.elf
File truncated	/var/log/auth.log	x86_64.elf
File truncated	/var/log/wtmp	x86_64.elf
File truncated	/var/log/btmp	x86_64.elf
File truncated	/var/log/lastlog	x86_64.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

persistence privilege_escalation

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	x86_64.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	x86_64.elf

Modifies systemd 2 TTPs 2 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/sys-network-helper.service	x86_64.elf
File opened for modification	/etc/systemd/system/killer-helper.service	x86_64.elf

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-7.dat	upx

Changes its process name 10 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	orimhhh	1496	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	orimhhh	1496	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:5]	1497	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:1]	1502	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:1]	1502	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1501	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:2]	1503	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1501	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:4]	1612	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:3]	1611	x86_64.elf

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	x86_64.elf

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	x86_64.elf
File opened for reading	/proc/net/tcp6	x86_64.elf

Command and Scripting Interpreter: Unix Shell 1 TTPs 3 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1615	sh
1562	sh
1605	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/9/comm	x86_64.elf
File opened for reading	/proc/1049/exe	x86_64.elf
File opened for reading	/proc/1251/exe	x86_64.elf
File opened for reading	/proc/1551/exe	x86_64.elf
File opened for reading	/proc/1573/comm	x86_64.elf
File opened for reading	/proc/32/exe	x86_64.elf
File opened for reading	/proc/1037/exe	x86_64.elf
File opened for reading	/proc/1063/exe	x86_64.elf
File opened for reading	/proc/1308/exe	x86_64.elf
File opened for reading	/proc/1579/comm	x86_64.elf
File opened for reading	/proc/self/status	x86_64.elf
File opened for reading	/proc/596/exe	x86_64.elf
File opened for reading	/proc/1525/comm	x86_64.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1616/exe	x86_64.elf
File opened for reading	/proc/82/exe	x86_64.elf
File opened for reading	/proc/1314/exe	x86_64.elf
File opened for reading	/proc/1384/exe	x86_64.elf
File opened for reading	/proc/1600/exe	x86_64.elf
File opened for reading	/proc/165/comm	x86_64.elf
File opened for reading	/proc/564/comm	x86_64.elf
File opened for reading	/proc/987/comm	x86_64.elf
File opened for reading	/proc/463/cmdline	x86_64.elf
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/23/exe	x86_64.elf
File opened for reading	/proc/167/exe	x86_64.elf
File opened for reading	/proc/1075/exe	x86_64.elf
File opened for reading	/proc/977/cmdline	x86_64.elf
File opened for reading	/proc/1547/cmdline	x86_64.elf
File opened for reading	/proc/1556/cmdline	x86_64.elf
File opened for reading	/proc/1601/cmdline	x86_64.elf
File opened for reading	/proc/1527/comm	x86_64.elf
File opened for reading	/proc/1058/cmdline	x86_64.elf
File opened for reading	/proc/1536/cmdline	x86_64.elf
File opened for reading	/proc/1538/exe	x86_64.elf
File opened for reading	/proc/1559/exe	x86_64.elf
File opened for reading	/proc/1614/comm	x86_64.elf
File opened for reading	/proc/1594/comm	x86_64.elf
File opened for reading	/proc/21/exe	x86_64.elf
File opened for reading	/proc/1525/exe	x86_64.elf
File opened for reading	/proc/80/cmdline	x86_64.elf
File opened for reading	/proc/460/comm	x86_64.elf
File opened for reading	/proc/1018/comm	x86_64.elf
File opened for reading	/proc/661/exe	x86_64.elf
File opened for reading	/proc/1506/comm	x86_64.elf
File opened for reading	/proc/1522/exe	x86_64.elf
File opened for reading	/proc/175/cmdline	x86_64.elf
File opened for reading	/proc/674/cmdline	x86_64.elf
File opened for reading	/proc/1308/cmdline	x86_64.elf
File opened for reading	/proc/1104/comm	x86_64.elf
File opened for reading	/proc/1001/exe	x86_64.elf
File opened for reading	/proc/204/cmdline	x86_64.elf
File opened for reading	/proc/668/cmdline	x86_64.elf
File opened for reading	/proc/1505/cmdline	x86_64.elf
File opened for reading	/proc/1549/cmdline	x86_64.elf
File opened for reading	/proc/1565/cmdline	x86_64.elf
File opened for reading	/proc/1584/cmdline	x86_64.elf
File opened for reading	/proc/1490/exe	x86_64.elf
File opened for reading	/proc/1513/comm	x86_64.elf
File opened for reading	/proc/35/cmdline	x86_64.elf
File opened for reading	/proc/1593/cmdline	x86_64.elf
File opened for reading	/proc/1010/comm	x86_64.elf
File opened for reading	/proc/168/exe	x86_64.elf
File opened for reading	/proc/203/exe	x86_64.elf

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

T1016

pid	Process
1559	iptables-restore
1559	iptables-restore
1557	iptables-restore
1557	iptables-restore

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.sh7f3a.tmp.1503	x86_64.elf

Writes file to tmp directory 10 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ccieyl1p.le	collect2
File opened for modification	/tmp/.sh7f3a_ps.c	x86_64.elf
File opened for modification	/tmp/ccKkBDWI.s	cc1
File opened for modification	/tmp/cciXSgbA.o	gcc
File opened for modification	/tmp/cciXSgbA.o	as
File opened for modification	/tmp/ccUe7xnH.o	collect2
File opened for modification	/tmp/ccKkBDWI.s	gcc
File opened for modification	/tmp/ccwW6Mtr.res	gcc
File opened for modification	/tmp/ccdzfP3P.c	collect2
File opened for modification	/tmp/ccXHhoHy.ld	collect2

/tmp/x86_64.elf
/tmp/x86_64.elf
1⤵
- Modifies the dynamic linker configuration file
- Deletes itself
- Deletes system logs
- Modifies the /etc/hosts DNS resolution file
- Creates/modifies Cron job
- Deletes log files
- Enumerates active TCP sockets
- Modifies rc script
- Modifies systemd
- Changes its process name
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to shm directory
- Writes file to tmp directory
PID:1492
- /bin/sh
  sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable killer-helper.service 2>/dev/null"
  2⤵
  PID:1506
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1507
- - /bin/systemctl
    systemctl enable killer-helper.service
    3⤵
    - Reads runtime system information
    PID:1534
- /usr/sbin/iptables
  iptables -n -L LK_sh7f3a
  2⤵
  PID:1555
- /sbin/iptables
  iptables -n -L LK_sh7f3a
  2⤵
  PID:1555
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1557
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1557
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1559
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1559
- /bin/sh
  /bin/sh -c "systemctl daemon-reload 2>/dev/null;systemctl enable sys-network-helper 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1562
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1563
- - /bin/systemctl
    systemctl enable sys-network-helper
    3⤵
    PID:1584
- /bin/sh
  /bin/sh -c "gcc -shared -fPIC -nostartfiles -o /usr/lib/.sh7f3a.so /tmp/.sh7f3a_ps.c 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1605
- - /usr/bin/gcc
    gcc -shared -fPIC -nostartfiles -o /usr/lib/.sh7f3a.so /tmp/.sh7f3a_ps.c
    3⤵
    - Writes file to tmp directory
    PID:1606
  - - /usr/lib/gcc/x86_64-linux-gnu/7/cc1
      /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu /tmp/.sh7f3a_ps.c -quiet -dumpbase .sh7f3a_ps.c "-mtune=generic" "-march=x86-64" -auxbase .sh7f3a_ps -fPIC -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccKkBDWI.s
      4⤵
      Writes file to tmp directory
      PID:1607
  - - /usr/local/sbin/as
      as --64 -o /tmp/cciXSgbA.o /tmp/ccKkBDWI.s
      4⤵
      PID:1608
  - - /usr/local/bin/as
      as --64 -o /tmp/cciXSgbA.o /tmp/ccKkBDWI.s
      4⤵
      PID:1608
  - - /usr/sbin/as
      as --64 -o /tmp/cciXSgbA.o /tmp/ccKkBDWI.s
      4⤵
      PID:1608
  - - /usr/bin/as
      as --64 -o /tmp/cciXSgbA.o /tmp/ccKkBDWI.s
      4⤵
      Writes file to tmp directory
      PID:1608
  - - /usr/lib/gcc/x86_64-linux-gnu/7/collect2
      /usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccwW6Mtr.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -shared -z relro -o /usr/lib/.sh7f3a.so -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/cciXSgbA.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state
      4⤵
      Writes file to tmp directory
      PID:1609
    - - /usr/bin/ld
        
        /usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccwW6Mtr.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -shared -z relro -o /usr/lib/.sh7f3a.so -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/cciXSgbA.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state
        5⤵
        
        PID:1610
- /bin/sh
  /bin/sh -c "journalctl --rotate --vacuum-time=1s 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1615
- - /bin/journalctl
    journalctl --rotate "--vacuum-time=1s"
    3⤵
    - Deletes journal logs
    PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

Shared Modules

T1129

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Scheduled Task/Job

T1053

Cron

Defense Evasion

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Indicator Removal

T1070

Clear Linux or Mac System Logs