rekoobe | 2e81517ee4172c43a2084be1d584841704b3f602cafc2365de3bcb3d899e4fb8 | Triage

Sharing

General

Target

2e81517ee4172c43a2084be1d584841704b3f602cafc2365de3bcb3d899e4fb8
Size

84KB
Sample

221203-3q126abg9w
MD5

24b411d2407527c7a58317c6758dca09
SHA1

f85e3ef06c8b5cf8805a4df2560338f007cf3dd7
SHA256

2e81517ee4172c43a2084be1d584841704b3f602cafc2365de3bcb3d899e4fb8
SHA512

8efb648dade73d9cf34ce9adfc553d369c8302ba2c7c89d9e720e5ccfdfbc6646570c9580f07cee197597a2c8550ab3693561a08e34aca41fde20f1db17151fb
SSDEEP

1536:rV3T+Q0YNuV8NnUTnhhW+LUlP7oqHekyN/1H5xuM8VS:rVqxWUTnhhW+LOoq+xN/1Zx2o

Score

10^/10

rekoobe linux

Malware Config

Extracted

Family

rekoobe

C2

gz2vip.idcfengye.com:10131

Targets

- Target
  
  2e81517ee4172c43a2084be1d584841704b3f602cafc2365de3bcb3d899e4fb8
- Size
  
  84KB
- MD5
  
  24b411d2407527c7a58317c6758dca09
- SHA1
  
  f85e3ef06c8b5cf8805a4df2560338f007cf3dd7
- SHA256
  
  2e81517ee4172c43a2084be1d584841704b3f602cafc2365de3bcb3d899e4fb8
- SHA512
  
  8efb648dade73d9cf34ce9adfc553d369c8302ba2c7c89d9e720e5ccfdfbc6646570c9580f07cee197597a2c8550ab3693561a08e34aca41fde20f1db17151fb
- SSDEEP
  
  1536:rV3T+Q0YNuV8NnUTnhhW+LUlP7oqHekyN/1H5xuM8VS:rVqxWUTnhhW+LOoq+xN/1Zx2o
Score

8^/10
- Modifies hosts file
  Adds to hosts file used for mapping hosts to IP addresses.
- Writes DNS configuration
  Writes data to DNS resolver config file.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Dynamic Resolution

Impact

Tasks

static1

behavioral1