rekoobe | 12c1b1e48effe60eef7486b3ae3e458da403cd04c88c88fab7fca84d849ee3f5 | Triage

Sharing

General

Target

12c1b1e48effe60eef7486b3ae3e458da403cd04c88c88fab7fca84d849ee3f5
Size

84KB
Sample

221203-3m5k6sff45
MD5

69fc4610667464b37edb750cde2f5783
SHA1

60024cf6fa9adeb384e56367a3a7a7514788d806
SHA256

12c1b1e48effe60eef7486b3ae3e458da403cd04c88c88fab7fca84d849ee3f5
SHA512

07898cf5c48fb8fb4488019cff5067338412580b5801c1e4fdff9da4f32234b36c22c1710ba8a1e5e624cf2a9575cda7ff1c11ffcb3f55aacf6aac34e551af95
SSDEEP

1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3

Score

10^/10

rekoobe linux

Malware Config

Extracted

Family

rekoobe

C2

118.24.150.172:0630

www.sydwzl.cn:0630

Targets

- Target
  
  12c1b1e48effe60eef7486b3ae3e458da403cd04c88c88fab7fca84d849ee3f5
- Size
  
  84KB
- MD5
  
  69fc4610667464b37edb750cde2f5783
- SHA1
  
  60024cf6fa9adeb384e56367a3a7a7514788d806
- SHA256
  
  12c1b1e48effe60eef7486b3ae3e458da403cd04c88c88fab7fca84d849ee3f5
- SHA512
  
  07898cf5c48fb8fb4488019cff5067338412580b5801c1e4fdff9da4f32234b36c22c1710ba8a1e5e624cf2a9575cda7ff1c11ffcb3f55aacf6aac34e551af95
- SSDEEP
  
  1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3
Score

8^/10
- Writes DNS configuration
  Writes data to DNS resolver config file.
- Writes file to tmp directory
  Malware often drops required files in the /tmp directory.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Dynamic Resolution

Impact

Tasks

static1

behavioral1