285572a9f4a1050d435a6e328f1072f0a27be99b15e3024945ae5f9209999d8a | Triage

Analysis

max time kernel
0s
max time network
127s
platform
debian-9_armhf
resource
debian9-armhf-20221111-en
resource tags

arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19-11-2022 08:54

Sharing

Report Analysis Logs

General

Target

.python/oracle
Size

1KB
MD5

479802ea13cf2831af66477aeaad217d
SHA1

6177980a3088f4fec7dea668d3b94f12bca1564b
SHA256

168bda8019db76538375bd67f432c3b91ab28485ddd60ec0f353343178b4a784
SHA512

84e6155ac0e53c43064a1abf28c7219f1f8c0fac454dc9d00276f4f010d278cd7bef4585a65c8d0102951c062e1e7a5ccb9bad05940beeaec25815f122246cd0

Score

5^/10

Malware Config

Signatures

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/.python/oracle	/tmp/.python/oracle	oracle

/tmp/.python/oracle
/tmp/.python/oracle
1⤵
- Writes file to tmp directory
PID:419
- ./c
  ./c 22 -b -i eth0 -s 10
  2⤵
  PID:420
- /bin/sleep
  sleep 2
  2⤵
  PID:421
- ./prg
  ./prg -I bios.txt -U ouser.txt -L opass.txt -o vuln.txt
  2⤵
  PID:426
- /bin/sleep
  sleep 5
  2⤵
  PID:427
- /bin/rm
  rm -rf "*.find.22" bios.txt
  2⤵
  PID:430
- /bin/sleep
  sleep 1
  2⤵
  PID:431
- /bin/cat
  cat vuln.txt
  2⤵
  PID:432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads