Overview

overview

9

Static

static

cronb.sh

linux_amd64

9

cronb.sh

linux_armhf

9

cronb.sh

linux_mips

9

cronb.sh

linux_mipsel

9

Resubmissions

01/10/2024, 16:14

241001-tp164aycqp10

31/03/2022, 14:02

220331-rb4c7ahaek9

Sharing

Copy URL Twitter E-mail

General

  • Target
    cronb.sh
  • Size 79KB
  • Sample220331-rb4c7ahaek
  • SHA256 7d7d0b4353401225e8da8424a7e1c5edaa091b256bdd48b7dcb158befca0b205
  • MD5 SHA1 SHA512
Score
9/10
linuxpersistence

Malware Config

Targets

    • Target
      cronb.sh
    • Size 79KB
    • SHA256 7d7d0b4353401225e8da8424a7e1c5edaa091b256bdd48b7dcb158befca0b205
    • MD5 SHA1 SHA512
    Score
    9/10
    persistence

    • Deletes system logs

    • Writes file to system bin folder

    • Modifies hosts file

      Adds to hosts file used for mapping hosts to IP addresses.

    • Writes DNS configuration

      Writes data to DNS resolver config file.

    • Modifies rc script

      Adding/modifying system rc scripts is a common persistence mechanism.

      persistence

    • Write file to user bin folder

    • Reads CPU attributes

    • Enumerates kernel/hardware configuration

      Reads contents of /sys virtual filesystem to enumerate system information.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    • Writes file to tmp directory

      Malware often drops required files in the /tmp directory.

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v6

Tasks