Analysis
-
max time kernel
17207s -
max time network
161s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
submitted
25-06-2022 20:00
General
-
Target
38732f1c1c048dd9148dfef7b778ac964badbd3fc020a0dc0d69743eb976eed7
-
Size
121KB
-
MD5
d54c2dd1fc3b39e27e307646638f67a8
-
SHA1
4920e97636129aba57dfe8bf6c87c6b4ea3a13e2
-
SHA256
38732f1c1c048dd9148dfef7b778ac964badbd3fc020a0dc0d69743eb976eed7
-
SHA512
47ba5107dcafdd58a2f4e1993c4479c11ae6d176d11c586b5b253b372223441d202bf13d45a784708f8e22089e243c9f7e15c204786abf4a02ae8aade9c4b7e3
Score
8/10
Malware Config
Signatures
-
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
-
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
-
Modifies rc script 1 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
./38732f1c1c048dd9148dfef7b778ac964badbd3fc020a0dc0d69743eb976eed7./38732f1c1c048dd9148dfef7b778ac964badbd3fc020a0dc0d69743eb976eed71⤵
- Modifies rc script