5e25477af34314dc8fd4fe2013845ec55572ac213148b70499b928bc4af1f1c1

Analysis

max time kernel
0s
max time network
102s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
12-11-2022 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sliver-server_linux
Size

192.7MB
MD5

42031b2317e99abdb91c95188056093f
SHA1

c922a24c730f4948c094f5d314bfa7d528341ed8
SHA256

5e25477af34314dc8fd4fe2013845ec55572ac213148b70499b928bc4af1f1c1
SHA512

e6dc4bc64fadfbcef9fe4c11ca4e5b1341aed23b273b7d5305aa47ed16fb7ea337e1e4d767569f3230ac47bf181b498db0615a92df2b18d4b6914d87ffa62623
SSDEEP

3145728:+s730yJtDa7gu/IRJXtv0Wpy3PcynhPS+3niQsJPbQuo600Sl5Katy8WlV:+e3DD4gu/SNIPct+3iZJPFC/p9W

Score

5^/10

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	sliver-server_linux

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/stat	/proc/stat	sliver-server_linux

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/sliver-server_linux	/tmp/sliver-server_linux	sliver-server_linux

/tmp/sliver-server_linux
/tmp/sliver-server_linux
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:581

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads