5b03ea53097246f8f821284993394e591ac149a68e0f8116c592ebaae7f27299

Analysis

max time kernel
0s
max time network
154s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
03/10/2022, 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp/blux86
Size

45KB
MD5

77168f05d80f9f9465f2ecbd5ae6ce2c
SHA1

cfe8aad283942b1153bf18973bff0a317af989a5
SHA256

1f80fb038440c8f9ce55191850b88d71120ab7ed36e42305114d14ee6b4b768a
SHA512

490f96062d1cb7e7224c4439520664968b8363152537e3b7f493c96846a1bed25deeecf8ecb0cd042e7fdd6ce735fa8b1ec41c36b801dfb6ea9f0def6c9e53b6
SSDEEP

768:pvAfe9klHTUFPrZHyPudl/FDp2fV6KoJe6ZKW:T6HTzc9DpG6KOIW

Score

7^/10

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery

T1016

description	ioc	Process
/proc/net/route	/proc/net/route	blux86

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
/proc/net/route	/proc/net/route	blux86

/tmp/tmp/blux86
/tmp/tmp/blux86
1⤵
- Reads system routing table
- Reads system network configuration
PID:581

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads