Analysis date (UTC): 5 August 2024, 08:29Analysis environment: Ubuntu 22.04.2

systemd-udevd (deleted)

MD5:079A2A9CA1DA0F3E023DE3AE04E5D3E4
SHA1:1D8A7EE1266731A84E7031D1BEE446C8815ACCE6
SHA256:22615E5BF518C4236C94AF82B5689CD519ECCD99EAF55E90ABA45B5836B4FC36

Analysis result

Behavior activities

MALICIOUS

Connects to the CnC server

  • systemd-udevd (deleted).o (PID: 12940)

GH0ST has been detected (SURICATA)

  • systemd-udevd (deleted).o (PID: 12940)

SUSPICIOUS

Executes commands using command-line interpreter

  • bash (PID: 12934)
  • cron (PID: 12957)

Modifies file or directory owner

  • sudo (PID: 12928)

Checks the user who created the process

  • cron (PID: 12957)

Contacting a server suspected of hosting an CnC

  • systemd-udevd (deleted).o (PID: 12940)

INFO

No info indicators.

Threats

PIDProcessClassMessage
12940systemd-udevd (deleted).oMisc AttackET DROP Spamhaus DROP Listed Traffic Inbound group 5
12940systemd-udevd (deleted).oMalware Command and Control Activity DetectedET MALWARE Backdoor family PCRat/Gh0st CnC traffic
12940systemd-udevd (deleted).oA Network Trojan was detectedET MALWARE [ANY.RUN] Win32/Gh0stRat Keep-Alive
12940systemd-udevd (deleted).oA Network Trojan was detectedET MALWARE Linux/Xnote Keep-Alive
12940systemd-udevd (deleted).oMalware Command and Control Activity DetectedREMOTE [ANY.RUN] Win32/Gh0stRat Keep-Alive M1
12940systemd-udevd (deleted).oA Network Trojan was detectedET MALWARE Linux/Xnote Keep-Alive
12940systemd-udevd (deleted).oA Network Trojan was detectedET MALWARE [ANY.RUN] Win32/Gh0stRat Keep-Alive
12940systemd-udevd (deleted).oMalware Command and Control Activity DetectedREMOTE [ANY.RUN] Win32/Gh0stRat Keep-Alive M1
12940systemd-udevd (deleted).oA Network Trojan was detectedET MALWARE Linux/Xnote Keep-Alive
12940systemd-udevd (deleted).oA Network Trojan was detectedET MALWARE [ANY.RUN] Win32/Gh0stRat Keep-Alive

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN