Overview

overview

10

Static

static

10

75dda8e277...200463

linux_amd64

9

Analysis

  • max time kernel
    14082s
  • max time network
    148s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • submitted
    20-05-2022 13:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    75dda8e2779e13c234387fe6164ea7a71fe15e9753a6ee687ba5588ba2200463

  • Size

    2.2MB

  • MD5

    b97e572ff7fc887edd5085402e0b4e86

  • SHA1

    a7cd1e37de9b2e38d5dbaeac8124006e27d24281

  • SHA256

    75dda8e2779e13c234387fe6164ea7a71fe15e9753a6ee687ba5588ba2200463

  • SHA512

    724c3f2ee4dfda9aa7d452ca3491c13c689cf0bab058193e3097f1146c1b7195f86924c36e25bcb85c95fe5607c8b909f044bb69efababa7a04de471afe02b94

Score
9/10
antivm

Malware Config

Signatures

  • Attempts to identify hypervisor via CPU configuration 1 TTPs 1 IoCs

    Checks CPU information for indicators that the system is a virtual machine.

    antivm
  • Modifies hosts file 1 IoCs

    Adds to hosts file used for mapping hosts to IP addresses.

  • Writes DNS configuration 1 TTPs 1 IoCs

    Writes data to DNS resolver config file.

  • Reads CPU attributes 1 TTPs 2 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 6 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • ./75dda8e2779e13c234387fe6164ea7a71fe15e9753a6ee687ba5588ba2200463
    ./75dda8e2779e13c234387fe6164ea7a71fe15e9753a6ee687ba5588ba2200463
    1⤵
    • Attempts to identify hypervisor via CPU configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:577

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Dynamic Resolution

1
T1568

Impact

Replay Monitor

Loading Replay Monitor...

Downloads