285572a9f4a1050d435a6e328f1072f0a27be99b15e3024945ae5f9209999d8a | Triage

Analysis

max time kernel
0s
max time network
126s
platform
linux_armhf
resource
debian9-armhf-en-20211208
resource tags

arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19-11-2022 08:54

Sharing

Report Analysis Logs

General

Target

.python/ubuntu
Size

1KB
MD5

07f6dd9f5b022262665d8cc0f5037086
SHA1

3466c31fc60279e6758906272fa1724fb71384c2
SHA256

462b92c91fbc63e60ddf7c5dd59b12ec37d7bae767ac2c28b69d928782aae7e4
SHA512

2976d6b23821f5d97d8a07014ea54053391ccfeb074666fd56f900c2fe1f03dd9d3a4f7d6738a5587e4255487f0474985d375fe9420dfd3323722b3265586e13

Score

5^/10

Malware Config

Signatures

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/.python/ubuntu	/tmp/.python/ubuntu	ubuntu

/tmp/.python/ubuntu
/tmp/.python/ubuntu
1⤵
- Writes file to tmp directory
PID:346
- ./c
  ./c 22 -b -i eth0 -s 10
  2⤵
  PID:353
- /bin/sleep
  sleep 2
  2⤵
  PID:354
- ./prg
  ./prg -I bios.txt -u ubuntu -L ubpass.txt -o vuln.txt
  2⤵
  PID:355
- /bin/sleep
  sleep 5
  2⤵
  PID:356
- /bin/rm
  rm -rf "*.find.22" bios.txt
  2⤵
  PID:357
- /bin/sleep
  sleep 1
  2⤵
  PID:358
- /bin/cat
  cat vuln.txt
  2⤵
  PID:359

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads