Overview

overview

10

Static

static

10

ea1872b283...c4.bin

linux_amd64

6

ea1872b283...c4.bin

linux_mipsel

ea1872b283...c4.bin

linux_mips

Resubmissions

30-06-2021 16:31

210630-v7kg8l625j 10

28-06-2021 22:28

210628-nmx97k3rnn 10

Analysis

  • max time kernel
    19270s
  • max time network
    189s
  • platform
    linux_amd64
  • resource
    ubuntu-amd64
  • submitted
    30-06-2021 16:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4.bin

  • Size

    102KB

  • MD5

    395249d3e6dae1caff6b5b2e1f75bacd

  • SHA1

    29f16c046a344e0d0adfea80d5d7958d6b6b8cfa

  • SHA256

    ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4

  • SHA512

    54bf867c030f708eb0975825d7c8e4c1b3bca49451bc08ebc3bb9fbd10e9ffdce82332ca200ee960b8ce7dfee1247e52c4ca11041cd976aa7cee6d4957144714

Score
6/10

Malware Config

Signatures

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • ./ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4.bin
    ./ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4.bin
    1⤵
      PID:689
      • 
        "" "" ""
        2⤵
          PID:690
          • /bin/uname
            uname -a
            3⤵
              PID:691
            • /bin/hostname
              hostname
              3⤵
                PID:692
            • 
              "" "" ""
              2⤵
                PID:693
                • /bin/uname
                  uname -a
                  3⤵
                    PID:694
                  • /bin/hostname
                    hostname
                    3⤵
                      PID:695
                  • 
                    "" "" "pkill -9 vmx-*"
                    2⤵
                      PID:696
                      • /usr/bin/pkill
                        pkill -9 "vmx-*"
                        3⤵
                        • Reads CPU attributes
                        • Reads runtime system information
                        PID:697
                    • 
                      "" "" ""
                      2⤵
                        PID:698
                        • /usr/bin/awk
                          awk -F "\"*,\"*" "{system(\"esxcli vm process kill --type=force --world-id=\" \$1)}"
                          3⤵
                            PID:700

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads