285572a9f4a1050d435a6e328f1072f0a27be99b15e3024945ae5f9209999d8a | Triage

Analysis

max time kernel
0s
max time network
124s
platform
debian-9_mipsel
resource
debian9-mipsel-20221111-en
resource tags

arch:mipselimage:debian9-mipsel-20221111-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
19-11-2022 08:54

Sharing

Report Analysis Logs

General

Target

.python/postgres
Size

1KB
MD5

da9cfd0310c267339c2e2b6a3c3f7344
SHA1

154b67af273661d7c77e882572ab65b8accd6406
SHA256

26ec8bbbd2131b1b415d12b95e94eb12c7b5a750ad3a4a0de0f7627a56174b2c
SHA512

ac95b278ae42cfe1f4ccd8cc3a952930cba39d5d70b3f6230748a08a25d263ff8729d12258999d3e4f3c91005ba75183eded56ab0fbc2e901d4fc460976d0788

Score

5^/10

Malware Config

Signatures

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/.python/postgres	/tmp/.python/postgres	postgres

/tmp/.python/postgres
/tmp/.python/postgres
1⤵
- Writes file to tmp directory
PID:324
- ./c
  ./c 22 -b -i eth0 -s 10
  2⤵
  PID:330
- /bin/sleep
  sleep 2
  2⤵
  PID:331
- ./prg
  ./prg -I bios.txt -u postgres -L postpass.txt -o vuln.txt
  2⤵
  PID:332
- /bin/sleep
  sleep 5
  2⤵
  PID:333
- /bin/rm
  rm -rf "*.find.22" bios.txt
  2⤵
  PID:334
- /bin/sleep
  sleep 1
  2⤵
  PID:335
- /bin/cat
  cat vuln.txt
  2⤵
  PID:336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads