d1c1704f476afc77d1d42206fa037f81a608a8439bcb44d8e79d465bbb7370c4 | Triage

Sharing

General

Target

d1c1704f476afc77d1d42206fa037f81a608a8439bcb44d8e79d465bbb7370c4
Size

37KB
Sample

221124-fjeh9ade3w
MD5

4de3c6792f7644313046cc6aeeb87501
SHA1

c4778fc6a865c96eafd897793dc6d2b52314e071
SHA256

d1c1704f476afc77d1d42206fa037f81a608a8439bcb44d8e79d465bbb7370c4
SHA512

4a16b9af405b36d0e09f1f061aceea5ea99b8ddbd374adbab27260d89c740f86144d6d6159bc0e70af5cb3c9938835c142a98d0b5e4380b0b354d75e10c782f9
SSDEEP

384:E4NqqoC/XJIEe4Xz2Ye6/mBP0es4zFftyLjXJaujtBBifvzM5re2Mb:nNIEe4Xz2YeGmBPP1fKLNOgI

Score

8^/10

discovery linux

Malware Config

Targets

- Target
  
  d1c1704f476afc77d1d42206fa037f81a608a8439bcb44d8e79d465bbb7370c4
- Size
  
  37KB
- MD5
  
  4de3c6792f7644313046cc6aeeb87501
- SHA1
  
  c4778fc6a865c96eafd897793dc6d2b52314e071
- SHA256
  
  d1c1704f476afc77d1d42206fa037f81a608a8439bcb44d8e79d465bbb7370c4
- SHA512
  
  4a16b9af405b36d0e09f1f061aceea5ea99b8ddbd374adbab27260d89c740f86144d6d6159bc0e70af5cb3c9938835c142a98d0b5e4380b0b354d75e10c782f9
- SSDEEP
  
  384:E4NqqoC/XJIEe4Xz2Ye6/mBP0es4zFftyLjXJaujtBBifvzM5re2Mb:nNIEe4Xz2YeGmBPP1fKLNOgI
Score

8^/10

discovery
- Modifies hosts file
  Adds to hosts file used for mapping hosts to IP addresses.
- Writes DNS configuration
  Writes data to DNS resolver config file.
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Writes file to tmp directory
  Malware often drops required files in the /tmp directory.
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Dynamic Resolution

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4