Overview

overview

5

Static

static

4

var www ht...han.js

windows7-x64

1

var www ht...han.js

windows10-2004-x64

1

var www ht...022.js

windows7-x64

1

var www ht...022.js

windows10-2004-x64

1

var www ht...api.js

windows7-x64

1

var www ht...api.js

windows10-2004-x64

1

var www ht...h.alfa

ubuntu-18.04-amd64

5

var www ht...h.alfa

debian-9-armhf

5

var www ht...h.alfa

debian-9-mips

1

var www ht...h.alfa

debian-9-mipsel

5

var www ht...r.alfa

ubuntu-18.04-amd64

var www ht...r.alfa

debian-9-armhf

var www ht...r.alfa

debian-9-mips

var www ht...r.alfa

debian-9-mipsel

var www ht...l.alfa

ubuntu-18.04-amd64

5

var www ht...l.alfa

debian-9-armhf

1

var www ht...l.alfa

debian-9-mips

1

var www ht...l.alfa

debian-9-mipsel

5

var www ht...y.alfa

ubuntu-18.04-amd64

var www ht...y.alfa

debian-9-armhf

var www ht...y.alfa

debian-9-mips

var www ht...y.alfa

debian-9-mipsel

var www ht...han.js

windows7-x64

1

var www ht...han.js

windows10-2004-x64

1

var www ht...ory.js

windows7-x64

1

var www ht...ory.js

windows10-2004-x64

1

var www ht...a.html

windows7-x64

1

var www ht...a.html

windows10-2004-x64

1

var www ht...o.html

windows7-x64

1

var www ht...o.html

windows10-2004-x64

1

var www ht...oto.js

windows7-x64

1

var www ht...oto.js

windows10-2004-x64

1

Resubmissions

19-07-2023 21:16

230719-z4frlabb95 4

19-07-2023 21:13

230719-z2sndabb89 5

11-11-2022 04:56

221111-fkt1bsbcbk 5

Analysis

  • max time kernel
    0s
  • max time network
    103s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    11-11-2022 04:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    var www html kemhan/alfacgiapi/bash.alfa

  • Size

    1KB

  • MD5

    501e2358a0f82d8289dc51958bd81beb

  • SHA1

    ddbf3f121acff0c651dcea118333f610cc98b0c1

  • SHA256

    1bbacae70b0e11e051783879bb63f667b4ee88b6b5676eabc7b09ea9afbc113c

  • SHA512

    7e96a386e687738b404a06f54c96a690fa7c9c181969c68f4c72994a32286c33266303434c85ce117fa60ef326a626cd05fd5a1aafe653e29c972f336e284755

Score
5/10

Malware Config

Signatures

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/var www html kemhan/alfacgiapi/bash.alfa
    "/tmp/var www html kemhan/alfacgiapi/bash.alfa"
    1⤵
    • Writes file to tmp directory
    PID:577
  • /usr/bin/base64
    base64 --decode
    1⤵
      PID:580
    • /usr/bin/base64
      base64 --decode
      1⤵
        PID:583

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads