Overview
overview
9Static
static
InstaRepor...Bot.py
ubuntu-18.04-amd64
7InstaRepor...Bot.py
debian-9-armhf
1InstaRepor...Bot.py
debian-9-mips
1InstaRepor...Bot.py
debian-9-mipsel
1InstaRepor...out.py
windows7-x64
3InstaRepor...out.py
windows10-2004-x64
3InstaRepor...elp.py
windows7-x64
3InstaRepor...elp.py
windows10-2004-x64
3InstaRepor...ion.py
windows7-x64
3InstaRepor...ion.py
windows10-2004-x64
3InstaRepor...ack.py
ubuntu-18.04-amd64
1InstaRepor...ack.py
debian-9-armhf
1InstaRepor...ack.py
debian-9-mips
1InstaRepor...ack.py
debian-9-mipsel
1InstaRepor...les.py
windows7-x64
3InstaRepor...les.py
windows10-2004-x64
3InstaRepor...ogo.py
windows7-x64
3InstaRepor...ogo.py
windows10-2004-x64
3InstaRepor...ter.py
ubuntu-18.04-amd64
9InstaRepor...ter.py
debian-9-armhf
1InstaRepor...ter.py
debian-9-mips
1InstaRepor...ter.py
debian-9-mipsel
1InstaRepor...nts.py
windows7-x64
3InstaRepor...nts.py
windows10-2004-x64
3InstaRepor...ils.py
windows7-x64
3InstaRepor...ils.py
windows10-2004-x64
5InstaRepor...tup.sh
windows7-x64
3InstaRepor...tup.sh
windows10-2004-x64
3Analysis
-
max time kernel
0s -
max time network
102s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
29-11-2022 12:31
Static task
static1
Behavioral task
behavioral1
Sample
InstaReport-main/ReportBot.py
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral2
Sample
InstaReport-main/ReportBot.py
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral3
Sample
InstaReport-main/ReportBot.py
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral4
Sample
InstaReport-main/ReportBot.py
Resource
debian9-mipsel-20221111-en
Behavioral task
behavioral5
Sample
InstaReport-main/about.py
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
InstaReport-main/about.py
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
InstaReport-main/help.py
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
InstaReport-main/help.py
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
InstaReport-main/libs/animation.py
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
InstaReport-main/libs/animation.py
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
InstaReport-main/libs/attack.py
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral12
Sample
InstaReport-main/libs/attack.py
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral13
Sample
InstaReport-main/libs/attack.py
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral14
Sample
InstaReport-main/libs/attack.py
Resource
debian9-mipsel-20221111-en
Behavioral task
behavioral15
Sample
InstaReport-main/libs/check_modules.py
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
InstaReport-main/libs/check_modules.py
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
InstaReport-main/libs/logo.py
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
InstaReport-main/libs/logo.py
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
InstaReport-main/libs/proxy_harvester.py
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral20
Sample
InstaReport-main/libs/proxy_harvester.py
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral21
Sample
InstaReport-main/libs/proxy_harvester.py
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral22
Sample
InstaReport-main/libs/proxy_harvester.py
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral23
Sample
InstaReport-main/libs/user_agents.py
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
InstaReport-main/libs/user_agents.py
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
InstaReport-main/libs/utils.py
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
InstaReport-main/libs/utils.py
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
InstaReport-main/setup.sh
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
InstaReport-main/setup.sh
Resource
win10v2004-20221111-en
General
-
Target
InstaReport-main/libs/proxy_harvester.py
-
Size
5KB
-
MD5
f09668f57c9efeba7d03a3816f5198f3
-
SHA1
fd60c8ecc498d59bf4673fcbf525980e62d2b374
-
SHA256
bf61a917f402f5ec1064f235eb4318e8bcaa5ca651eaba366485ba46551f296d
-
SHA512
2e4663695777238f667113ed2e0f2d6f5eddd8baa0008267b78e4dc059fc16b18c87dd6dd2750617b2c0a805f8690d34a3f814c703d65ac664c375c122986fef
-
SSDEEP
96:lG2Hnwnqi69WN8dEGdZNXLI4PRrdEfPxDPird5EdeP20rdwBP2brdd3I3Mdc:lGQ3WN5NfPxQEdde3I3Mm
Malware Config
Signatures
-
Writes file to system bin folder 1 TTPs 1 IoCs
Processes:
ldconfigdescription ioc process /sbin/ldconfig /sbin/ldconfig ldconfig -
Write file to user bin folder 1 TTPs 1 IoCs
Processes:
python3description ioc process /usr/bin/pyvenv.cfg /usr/bin/pyvenv.cfg python3 -
Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.
Processes:
python3description ioc process /proc/self/status /proc/self/status python3 /proc/mounts /proc/mounts python3 /proc/self/fd /proc/self/fd -
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes:
python3description ioc process /tmp/InstaReport-main/libs/proxy_harvester.py /tmp/InstaReport-main/libs/proxy_harvester.py python3 /tmp/InstaReport-main/libs /tmp/InstaReport-main/libs python3
Processes
-
/tmp/InstaReport-main/libs/proxy_harvester.py/tmp/InstaReport-main/libs/proxy_harvester.py1⤵
-
/usr/local/sbin/python3python3 /tmp/InstaReport-main/libs/proxy_harvester.py1⤵
-
/usr/local/bin/python3python3 /tmp/InstaReport-main/libs/proxy_harvester.py1⤵
-
/usr/sbin/python3python3 /tmp/InstaReport-main/libs/proxy_harvester.py1⤵
-
/usr/bin/python3python3 /tmp/InstaReport-main/libs/proxy_harvester.py1⤵
- Write file to user bin folder
- Reads runtime system information
- Writes file to tmp directory
-
/sbin/ldconfig/sbin/ldconfig -p2⤵
- Writes file to system bin folder
-
/sbin/ldconfig.real/sbin/ldconfig.real -p2⤵
-
/bin/sh/bin/sh -c "uname -p 2> /dev/null"2⤵
-
/bin/unameuname -p3⤵