Overview

overview

5

Static

static

9536a1518f...05b5d8

ubuntu-18.04-amd64

5

9536a1518f...05b5d8

debian-9-armhf

5

9536a1518f...05b5d8

debian-9-mips

5

9536a1518f...05b5d8

debian-9-mipsel

5

Analysis

  • max time kernel
    0s
  • max time network
    157s
  • platform
    linux_armhf
  • resource
    debian9-armhf-en-20211208
  • resource tags

    arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    26-11-2022 16:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9536a1518fd4fc81c51ce508f99637e1b3f5756e36896f19ad78b21d0005b5d8

  • Size

    753B

  • MD5

    8bf07c56cdca230ea451333790002498

  • SHA1

    1e6470a691ff425e9b313df92d50ee531a57e037

  • SHA256

    9536a1518fd4fc81c51ce508f99637e1b3f5756e36896f19ad78b21d0005b5d8

  • SHA512

    7f513c376376f86cdd63b10735da1a6f1587aa5a4d51321a8bdd71e21e05541d109649f0eaa18c8591653642d582cc08878d72f1c71c42eab7ed472b8c20d62c

Score
5/10

Malware Config

Signatures

  • Writes file to tmp directory 18 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/9536a1518fd4fc81c51ce508f99637e1b3f5756e36896f19ad78b21d0005b5d8
    /tmp/9536a1518fd4fc81c51ce508f99637e1b3f5756e36896f19ad78b21d0005b5d8
    1⤵
    • Writes file to tmp directory
    PID:357
    • /bin/cat
      cat
      2⤵
        PID:358
      • /usr/bin/gcc
        gcc -w -fPIC -shared -o /tmp/libxpl.so /tmp/libxpl.c
        2⤵
        • Writes file to tmp directory
        PID:359
      • /bin/ping
        ping
        2⤵
          PID:367
        • /bin/cat
          cat /tmp/libxpl.so
          2⤵
          • Writes file to tmp directory
          PID:368
        • /bin/rm
          rm -rf /tmp/libxpl.c /tmp/libxpl.so
          2⤵
          • Writes file to tmp directory
          PID:369
        • /bin/ping
          ping
          2⤵
            PID:370
          • /bin/sh
            /bin/sh -i
            2⤵
              PID:370
          • /usr/lib/gcc/arm-linux-gnueabihf/6/cc1
            /usr/lib/gcc/arm-linux-gnueabihf/6/cc1 -quiet -imultilib . -imultiarch arm-linux-gnueabihf /tmp/libxpl.c -quiet -dumpbase libxpl.c "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" -mthumb "-mtls-dialect=gnu" -auxbase libxpl -w -fPIC -o /tmp/cc1KAU5e.s
            1⤵
            • Writes file to tmp directory
            PID:363
          • /usr/local/sbin/as
            as -W "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccLStA6y.o /tmp/cc1KAU5e.s
            1⤵
              PID:364
            • /usr/local/bin/as
              as -W "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccLStA6y.o /tmp/cc1KAU5e.s
              1⤵
                PID:364
              • /usr/sbin/as
                as -W "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccLStA6y.o /tmp/cc1KAU5e.s
                1⤵
                  PID:364
                • /usr/bin/as
                  as -W "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccLStA6y.o /tmp/cc1KAU5e.s
                  1⤵
                  • Writes file to tmp directory
                  PID:364
                • /usr/lib/gcc/arm-linux-gnueabihf/6/collect2
                  /usr/lib/gcc/arm-linux-gnueabihf/6/collect2 -plugin /usr/lib/gcc/arm-linux-gnueabihf/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/arm-linux-gnueabihf/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccXiRwae.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -shared -X "--hash-style=gnu" -m armelf_linux_eabi -o /tmp/libxpl.so /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crti.o /usr/lib/gcc/arm-linux-gnueabihf/6/crtbeginS.o -L/usr/lib/gcc/arm-linux-gnueabihf/6 -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../.. -L/lib/arm-linux-gnueabihf -L/usr/lib/arm-linux-gnueabihf /tmp/ccLStA6y.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/arm-linux-gnueabihf/6/crtendS.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crtn.o
                  1⤵
                  • Writes file to tmp directory
                  PID:365
                • /usr/bin/ld
                  /usr/bin/ld -plugin /usr/lib/gcc/arm-linux-gnueabihf/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/arm-linux-gnueabihf/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccXiRwae.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -shared -X "--hash-style=gnu" -m armelf_linux_eabi -o /tmp/libxpl.so /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crti.o /usr/lib/gcc/arm-linux-gnueabihf/6/crtbeginS.o -L/usr/lib/gcc/arm-linux-gnueabihf/6 -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../.. -L/lib/arm-linux-gnueabihf -L/usr/lib/arm-linux-gnueabihf /tmp/ccLStA6y.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/arm-linux-gnueabihf/6/crtendS.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crtn.o
                  1⤵
                  • Writes file to tmp directory
                  PID:366

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads