rekoobe | 870d6c202fcc72088ff5d8e71cc0990777a7621851df10ba74d0e07d19174887 | Triage

Sharing

General

Target

870d6c202fcc72088ff5d8e71cc0990777a7621851df10ba74d0e07d19174887
Size

84KB
Sample

221203-3mrz3sbd9z
MD5

d9f00f71efabdfcca7c63d4b0805673c
SHA1

49c4aa2812535884bd9d3a564e7656dec150933a
SHA256

870d6c202fcc72088ff5d8e71cc0990777a7621851df10ba74d0e07d19174887
SHA512

ff281ae4e5c59e02fa11f5fadd92ba73f7fdb26c9451ab166518a3dee19cd5ed8df7cb9d9fce5e1ba737eafbd4eb2cf921ff2be9a94b1487c60c838bacfa8c24
SSDEEP

1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3

Score

10^/10

rekoobe linux

Malware Config

Extracted

Family

rekoobe

C2

23.100.88.61:53

Targets

- Target
  
  870d6c202fcc72088ff5d8e71cc0990777a7621851df10ba74d0e07d19174887
- Size
  
  84KB
- MD5
  
  d9f00f71efabdfcca7c63d4b0805673c
- SHA1
  
  49c4aa2812535884bd9d3a564e7656dec150933a
- SHA256
  
  870d6c202fcc72088ff5d8e71cc0990777a7621851df10ba74d0e07d19174887
- SHA512
  
  ff281ae4e5c59e02fa11f5fadd92ba73f7fdb26c9451ab166518a3dee19cd5ed8df7cb9d9fce5e1ba737eafbd4eb2cf921ff2be9a94b1487c60c838bacfa8c24
- SSDEEP
  
  1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3
Score

8^/10
- Writes DNS configuration
  Writes data to DNS resolver config file.
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Writes file to tmp directory
  Malware often drops required files in the /tmp directory.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Dynamic Resolution

Impact

Tasks

static1

behavioral1