d7361457b9a5090057132219b1212d6fdee117069039df7baf757ba5b5d52d99 | Triage

Analysis

max time kernel
0s
max time network
153s
platform
linux_mips
resource
debian9-mipsbe-en-20211208
resource tags

arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27-11-2022 17:56

Sharing

Report Analysis Logs

General

Target

.new/auto
Size

321B
MD5

ca67eae5a1d96c9c3360081112ed3f3d
SHA1

7b1972c14b16bcb7894cf253a0a6f35d20955050
SHA256

f1f2050b111aaf87fc959de7e42bb4a128324a3b49e1725bb46ff1de3741287d
SHA512

2a71f12606fa889254af881389e3b6c8a908a0f8494881da23f13b3fabb984c783c06011eddd5a615f3f89f57a5ded545edf069bbfbf2b1b728c74137820616b

Score

5^/10

Malware Config

Signatures

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	crontab
/proc/filesystems	/proc/filesystems	crontab

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/.new/auto	/tmp/.new/auto	auto

/tmp/.new/auto
/tmp/.new/auto
1⤵
- Writes file to tmp directory
PID:331
- /bin/cat
  cat egg.dir
  2⤵
  PID:332
- /usr/bin/crontab
  crontab cron.d
  2⤵
  - Reads runtime system information
  PID:333
- /bin/grep
  grep update
  2⤵
  PID:338
- /usr/bin/crontab
  crontab -l
  2⤵
  - Reads runtime system information
  PID:337
- /bin/chmod
  chmod u+x update
  2⤵
  PID:339

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads