Overview

overview

6

Static

static

10

d6762eff16...63.bin

linux_amd64

6

d6762eff16...63.bin

linux_mipsel

d6762eff16...63.bin

linux_mips

Analysis

  • max time kernel
    0s
  • max time network
    187s
  • platform
    linux_amd64
  • resource
    ubuntu-amd64
  • submitted
    28-06-2021 22:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d6762eff16452434ac1acc127f082906cc1ae5b0ff026d0d4fe725711db47763.bin

  • Size

    102KB

  • MD5

    e199f02ffcf1b1769c8aeb580f627267

  • SHA1

    9586ebc83a1b6949e08820b46faf72ee5b132bca

  • SHA256

    d6762eff16452434ac1acc127f082906cc1ae5b0ff026d0d4fe725711db47763

  • SHA512

    de537e7032c38c6fcaf1947c6a5789150e7097f2093a400f6514b87b5d49742ab54cadfc435b2bc3fc3a3527e6249d9b8c5d8b405e3856d8c595c6fd81223c6f

Score
6/10

Malware Config

Signatures

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • ./d6762eff16452434ac1acc127f082906cc1ae5b0ff026d0d4fe725711db47763.bin
    ./d6762eff16452434ac1acc127f082906cc1ae5b0ff026d0d4fe725711db47763.bin
    1⤵
      PID:565
      • 
        "" "" ""
        2⤵
          PID:566
          • /bin/uname
            uname -a
            3⤵
              PID:567
            • /bin/hostname
              hostname
              3⤵
                PID:568
            • 
              "" "" ""
              2⤵
                PID:569
                • /bin/uname
                  uname -a
                  3⤵
                    PID:570
                  • /bin/hostname
                    hostname
                    3⤵
                      PID:571
                  • 
                    "" "" "pkill -9 vmx-*"
                    2⤵
                      PID:572
                      • /usr/bin/pkill
                        pkill -9 "vmx-*"
                        3⤵
                        • Reads CPU attributes
                        • Reads runtime system information
                        PID:573
                    • 
                      "" "" ""
                      2⤵
                        PID:574
                        • /usr/bin/awk
                          awk -F "\"*,\"*" "{system(\"esxcli vm process kill --type=force --world-id=\" \$1)}"
                          3⤵
                            PID:576

                      Network

                      MITRE ATT&CK Matrix ATT&CK v6

                      Initial Access

                      Execution

                      Persistence

                      Privilege Escalation

                      Defense Evasion

                      Credential Access

                      Discovery

                      System Information Discovery

                      1
                      T1082

                      Lateral Movement

                      Collection

                      Exfiltration

                      Command and Control

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads