Overview

overview

10

Static

static

10

00a2abe70a...58.bin

debian-9-mipsel

9

Analysis

  • max time kernel
    23595s
  • max time network
    152s
  • platform
    linux_mipsel
  • resource
    debian9-mipsel-en-20211208
  • resource tags

    arch:mipselimage:debian9-mipsel-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    07/09/2022, 19:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    00a2abe70a76a4cb942d12add8358f0ac751603a9fa6bd7a959095841aee1758.bin

  • Size

    94KB

  • MD5

    2d73095da6de946a55cf531e9611cd8a

  • SHA1

    d933d6e78f762a2740bb75d2df0c2e569dd262ff

  • SHA256

    00a2abe70a76a4cb942d12add8358f0ac751603a9fa6bd7a959095841aee1758

  • SHA512

    57871ec0e7edd0380a2e1ce0735312e255485ac03648e019479c90ba2493429f803c20d112ec8460333802abc5a2ba0f16100f38386f88d1b79c069c2456dbb2

  • SSDEEP

    1536:EPYu5myv9Ud/VerUg3iQ1b4ja21P3FNZdxtNI1cqV:EPYu5pv9oEoja21P1NOfV

Score
9/10
discovery

Malware Config

Signatures

  • Contacts a large (23354) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Writes file to system bin folder 1 TTPs 1 IoCs
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Write file to user bin folder 1 TTPs 1 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 20 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/00a2abe70a76a4cb942d12add8358f0ac751603a9fa6bd7a959095841aee1758.bin
    /tmp/00a2abe70a76a4cb942d12add8358f0ac751603a9fa6bd7a959095841aee1758.bin
    1⤵
      PID:331
    • /bin/sh
      sh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/00a2abe70a76a4cb942d12add8358f0ac751603a9fa6bd7a959095841aee1758.bin bin/busybox; chmod 777 bin/busybox"
      1⤵
        PID:332
        • /bin/rm
          rm -rf bin/busybox
          2⤵
            PID:334
          • /bin/mkdir
            mkdir bin
            2⤵
            • Reads runtime system information
            PID:335
          • /bin/mv
            mv /tmp/00a2abe70a76a4cb942d12add8358f0ac751603a9fa6bd7a959095841aee1758.bin bin/busybox
            2⤵
            • Reads runtime system information
            PID:337
          • /bin/chmod
            chmod 777 bin/busybox
            2⤵
              PID:341

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads