285572a9f4a1050d435a6e328f1072f0a27be99b15e3024945ae5f9209999d8a | Triage

Analysis

max time kernel
0s
max time network
127s
platform
debian-9_armhf
resource
debian9-armhf-20221111-en
resource tags

arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19-11-2022 08:54

Sharing

Report Analysis Logs

General

Target

.python/test
Size

1KB
MD5

a9a0fef37ea6973f5dfe2e10ba96d7f8
SHA1

996ef7a87017ccd480b4cd287e0a1d00805c8bea
SHA256

aa3274527237965ae5741c7ba15de36b5629202c2e61595667ad6cfcfb55c2f6
SHA512

421ee425e98192cea9f1c0a9e69dc0cf6b87dea07954faebe1446d25328e1c62492e4a83e43d4cc72d781b1f603dcc26c2eedfda98e8e904d614014600952a49

Score

5^/10

Malware Config

Signatures

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/.python/test	/tmp/.python/test	test

/tmp/.python/test
/tmp/.python/test
1⤵
- Writes file to tmp directory
PID:361
- ./c
  ./c 22 -b -i eth0 -s 10
  2⤵
  PID:366
- /bin/sleep
  sleep 2
  2⤵
  PID:367
- ./prg
  ./prg -I bios.txt -U tuser.txt -L tpass.txt -o vuln.txt
  2⤵
  PID:368
- /bin/sleep
  sleep 5
  2⤵
  PID:369
- /bin/rm
  rm -rf "*.find.22" bios.txt
  2⤵
  PID:372
- /bin/sleep
  sleep 1
  2⤵
  PID:373
- /bin/cat
  cat vuln.txt
  2⤵
  PID:374

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads