518668d64e5e5ec824bb002f8860c4142f0cacdb8e72a9f76b73ae30f1474007

Analysis

max time kernel
0s
max time network
152s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
18-07-2022 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89.42.133.67/x86
Size

113KB
MD5

cf0a594291b385474e07912f9fd4b583
SHA1

1e7379cde7eee43e873e4102b95b6a53b7b270f1
SHA256

f990b88a05bd94fd9aca6b6e048c83efa35163615978760c71e1bcb16ed4a849
SHA512

a3bfb7962d70f0910be03de6117c4b8ab22ad088b1ef0a0a693abaa330f78eb8b0b777b9e196689bc85ef571956f41009f5f71541adc8c964e8d5658b7d2efdc

Score

9^/10

Malware Config

Signatures

Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery

T1016

description	ioc	Process
/proc/net/route	/proc/net/route	x86

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
/proc/net/route	/proc/net/route	x86

/tmp/89.42.133.67/x86
/tmp/89.42.133.67/x86
1⤵
- Reads system routing table
- Reads system network configuration
PID:570

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads