Analysis
-
max time kernel
1090s -
max time network
159s -
platform
debian-9_mips -
resource
debian9-mipsbe-20221111-en -
resource tags
-
submitted
24-11-2022 04:53
General
-
Target
d1c1704f476afc77d1d42206fa037f81a608a8439bcb44d8e79d465bbb7370c4
-
Size
37KB
-
MD5
4de3c6792f7644313046cc6aeeb87501
-
SHA1
c4778fc6a865c96eafd897793dc6d2b52314e071
-
SHA256
d1c1704f476afc77d1d42206fa037f81a608a8439bcb44d8e79d465bbb7370c4
-
SHA512
4a16b9af405b36d0e09f1f061aceea5ea99b8ddbd374adbab27260d89c740f86144d6d6159bc0e70af5cb3c9938835c142a98d0b5e4380b0b354d75e10c782f9
-
SSDEEP
384:E4NqqoC/XJIEe4Xz2Ye6/mBP0es4zFftyLjXJaujtBBifvzM5re2Mb:nNIEe4Xz2YeGmBPP1fKLNOgI
Score
8/10
Malware Config
Signatures
-
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
-
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/d1c1704f476afc77d1d42206fa037f81a608a8439bcb44d8e79d465bbb7370c4/tmp/d1c1704f476afc77d1d42206fa037f81a608a8439bcb44d8e79d465bbb7370c41⤵
- Writes file to tmp directory
-
/usr/local/sbin/unameuname -sr2⤵
-
-
/usr/local/bin/unameuname -sr2⤵
-
-
/usr/sbin/unameuname -sr2⤵
-
-
/usr/bin/unameuname -sr2⤵
-
-
/sbin/unameuname -sr2⤵
-
-
/bin/unameuname -sr2⤵
-