9b4dfaca873961174ba935fddaf696145afe7bbf5734509f95feb54f3584fd9a

Resubmissions

08/09/2022, 17:48

220908-wdj5jscchn 1

08/09/2022, 16:49

08/09/2022, 16:46

08/09/2022, 16:45

08/09/2022, 06:26

08/09/2022, 06:00

Analysis

max time kernel
23633s
max time network
204s
platform
linux_mips
resource
debian9-mipsbe-en-20211208
resource tags

arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
08/09/2022, 06:00

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

9b4dfaca873961174ba935fddaf696145afe7bbf5734509f95feb54f3584fd9a.elf
Size

22KB
MD5

ecbe1b1e30a1f4bffaf1d374014c877f
SHA1

86906b140b019fdedaaba73948d0c8f96a6b1b42
SHA256

9b4dfaca873961174ba935fddaf696145afe7bbf5734509f95feb54f3584fd9a
SHA512

c32be39eb99eaad7a3e63ccf2c23819d16ff904cb482f49ada199439331676ba03ec5c5edc039243c90b27555c7d0912f3b0104742480ecaeed7f0ff4d3302bb
SSDEEP

384:aeFHMJnorHlag/2x4v0wJ7KStX/u7KLc/Cuc+r:WorHcgt/JKSh/xc/Curr

Score

8^/10

persistence

Malware Config

Signatures

Modifies hosts file 1 IoCs

Adds to hosts file used for mapping hosts to IP addresses.

description	ioc
/etc/hosts	/etc/hosts

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

description	ioc
/etc/resolv.conf	/etc/resolv.conf

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task

T1053

description	ioc
/etc/cron.d/.placeholder	/etc/cron.d/.placeholder
/etc/crontab	/etc/crontab

Creates/modifies environment variables 1 TTPs 4 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence

Hijack Execution Flow

T1574

description	ioc
/etc/environment	/etc/environment
/etc/profile.d	/etc/profile.d
/etc/profile	/etc/profile
/etc/bash.bashrc	/etc/bash.bashrc

Modifies Bash startup script 1 TTPs 3 IoCs

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
/etc/bash.bashrc	/etc/bash.bashrc
/etc/profile.d	/etc/profile.d
/etc/profile	/etc/profile

Modifies init.d 1 TTPs 10 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
/etc/init.d/cron	/etc/init.d/cron
/etc/init.d/dbus	/etc/init.d/dbus
/etc/init.d/networking	/etc/init.d/networking
/etc/init.d/hwclock.sh	/etc/init.d/hwclock.sh
/etc/init.d/sudo	/etc/init.d/sudo
/etc/init.d/procps	/etc/init.d/procps
/etc/init.d/ssh	/etc/init.d/ssh
/etc/init.d/rsyslog	/etc/init.d/rsyslog
/etc/init.d/kmod	/etc/init.d/kmod
/etc/init.d/udev	/etc/init.d/udev

Modifies rc script 1 TTPs 17 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
/etc/rc1.d/K01rsyslog	/etc/rc1.d/K01rsyslog
/etc/rc3.d/S01ssh	/etc/rc3.d/S01ssh
/etc/rc3.d/S01dbus	/etc/rc3.d/S01dbus
/etc/rc2.d/S01rsyslog	/etc/rc2.d/S01rsyslog
/etc/rc2.d/S01ssh	/etc/rc2.d/S01ssh
/etc/rc4.d/S01ssh	/etc/rc4.d/S01ssh
/etc/rc4.d/S01rsyslog	/etc/rc4.d/S01rsyslog
/etc/rc3.d/S01cron	/etc/rc3.d/S01cron
/etc/rc3.d/S01rsyslog	/etc/rc3.d/S01rsyslog
/etc/rc2.d/S01cron	/etc/rc2.d/S01cron
/etc/rc2.d/S01dbus	/etc/rc2.d/S01dbus
/etc/rc4.d/S01cron	/etc/rc4.d/S01cron
/etc/rc5.d/S01ssh	/etc/rc5.d/S01ssh
/etc/rc5.d/S01cron	/etc/rc5.d/S01cron
/etc/rc5.d/S01dbus	/etc/rc5.d/S01dbus
/etc/rc4.d/S01dbus	/etc/rc4.d/S01dbus
/etc/rc5.d/S01rsyslog	/etc/rc5.d/S01rsyslog

/tmp/9b4dfaca873961174ba935fddaf696145afe7bbf5734509f95feb54f3584fd9a.elf
/tmp/9b4dfaca873961174ba935fddaf696145afe7bbf5734509f95feb54f3584fd9a.elf
1⤵
PID:332