Overview

overview

6

Static

static

10

3d375d0ead...7d.bin

linux_amd64

6

3d375d0ead...7d.bin

linux_mipsel

3d375d0ead...7d.bin

linux_mips

Resubmissions

30-06-2021 16:31

210630-bnf9h5f4vx 10

28-06-2021 22:59

210628-h91ft82jq2 10

Analysis

  • max time kernel
    19120s
  • max time network
    189s
  • platform
    linux_amd64
  • resource
    ubuntu-amd64
  • submitted
    28-06-2021 22:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d.bin

  • Size

    102KB

  • MD5

    96a157e4c0bef22e0cea1299f88d4745

  • SHA1

    446771415864f4916df33aad1aa7e42fa104adee

  • SHA256

    3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d

  • SHA512

    697071bac6f86ea1b0421306dbc87e926973f061b8eff4608f9a98ada622fe2bdcd45a180591792dd14de54a0b87301ae02f0a3a222e93eb412b340ccc990377

Score
6/10

Malware Config

Signatures

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • ./3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d.bin
    ./3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d.bin
    1⤵
      PID:688
      • 
        "" "" ""
        2⤵
          PID:689
          • /bin/uname
            uname -a
            3⤵
              PID:690
            • /bin/hostname
              hostname
              3⤵
                PID:691
            • 
              "" "" ""
              2⤵
                PID:692
                • /bin/uname
                  uname -a
                  3⤵
                    PID:693
                  • /bin/hostname
                    hostname
                    3⤵
                      PID:694
                  • 
                    "" "" "pkill -9 vmx-*"
                    2⤵
                      PID:695
                      • /usr/bin/pkill
                        pkill -9 "vmx-*"
                        3⤵
                        • Reads CPU attributes
                        • Reads runtime system information
                        PID:696
                    • 
                      "" "" ""
                      2⤵
                        PID:697
                        • /usr/bin/awk
                          awk -F "\"*,\"*" "{system(\"esxcli vm process kill --type=force --world-id=\" \$1)}"
                          3⤵
                            PID:699

                      Network

                      MITRE ATT&CK Matrix ATT&CK v6

                      Initial Access

                      Execution

                      Persistence

                      Privilege Escalation

                      Defense Evasion

                      Credential Access

                      Discovery

                      System Information Discovery

                      1
                      T1082

                      Lateral Movement

                      Collection

                      Exfiltration

                      Command and Control

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads