rekoobe | 55dbdb84c40d9dc8c5aaf83226ca00a3395292cc8f884bdc523a44c2fd431c7b | Triage

Sharing

General

Target

55dbdb84c40d9dc8c5aaf83226ca00a3395292cc8f884bdc523a44c2fd431c7b
Size

84KB
Sample

221203-3mjnpsbd8v
MD5

ab811a9e4cc9fe3dfddff5f6635b599b
SHA1

cbe804bc2ce4a20281d33f1af5d99931e2162ff7
SHA256

55dbdb84c40d9dc8c5aaf83226ca00a3395292cc8f884bdc523a44c2fd431c7b
SHA512

08d8e82f4e9859c375644793aaf58ff15e47a3c5acf0db5700f368f40427a49c58d1fac862c593dda493d7f66ab224d35136d74950dacc819824e47f1243211c
SSDEEP

1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3

Score

10^/10

rekoobe linux

Malware Config

Extracted

Family

rekoobe

C2

118.24.150.172:0456

www.sydwzl.cn:0456

Targets

- Target
  
  55dbdb84c40d9dc8c5aaf83226ca00a3395292cc8f884bdc523a44c2fd431c7b
- Size
  
  84KB
- MD5
  
  ab811a9e4cc9fe3dfddff5f6635b599b
- SHA1
  
  cbe804bc2ce4a20281d33f1af5d99931e2162ff7
- SHA256
  
  55dbdb84c40d9dc8c5aaf83226ca00a3395292cc8f884bdc523a44c2fd431c7b
- SHA512
  
  08d8e82f4e9859c375644793aaf58ff15e47a3c5acf0db5700f368f40427a49c58d1fac862c593dda493d7f66ab224d35136d74950dacc819824e47f1243211c
- SSDEEP
  
  1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3
Score

8^/10
- Writes DNS configuration
  Writes data to DNS resolver config file.
- Writes file to tmp directory
  Malware often drops required files in the /tmp directory.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Dynamic Resolution

Impact

Tasks

static1

behavioral1