Overview

overview

10

Static

static

10

587f0558b4...98a74b

debian-9-armhf

9

Analysis

  • max time kernel
    37592s
  • max time network
    153s
  • platform
    linux_armhf
  • resource
    debian9-armhf-en-20211208
  • resource tags

    arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    16/02/2023, 19:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    587f0558b4ee34a843045ac64d98a74b

  • Size

    147KB

  • MD5

    587f0558b4ee34a843045ac64d98a74b

  • SHA1

    0bb45eed36e8af790ebb424b1bb465887a57e2c4

  • SHA256

    ef22c074a9807d18bb790b7f42f36ae6a361195d218bc93afe1a88b2f31c9f66

  • SHA512

    2a3d3fe6a8c6dce3a607df1ed8c117ad1e32ce12a80273b6443d6b3288cc5f9d4e32c827136f792720470d90368a2e03be52e14007a4445c3594650573140ba8

  • SSDEEP

    3072:CJLce3pC5mT7naLHbz4N9GUJURIJ1FVEXkkTM/9oIMY:CJLcePnaLHbz4NMUJdHVEXkYM/9LMY

Score
9/10
discovery

Malware Config

Signatures

  • Contacts a large (35825) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/587f0558b4ee34a843045ac64d98a74b
    /tmp/587f0558b4ee34a843045ac64d98a74b
    1⤵
      PID:355
      • /bin/sh
        /bin/sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/587f0558b4ee34a843045ac64d98a74b bin/watchdog; chmod 777 ��4;bin/watchdog�þ"
        2⤵
          PID:356
          • /bin/rm
            rm -rf bin/watchdog
            3⤵
              PID:357
            • /bin/mkdir
              mkdir bin
              3⤵
              • Reads runtime system information
              PID:358
            • /bin/mv
              mv /tmp/587f0558b4ee34a843045ac64d98a74b bin/watchdog
              3⤵
              • Reads runtime system information
              PID:363
            • /bin/chmod
              chmod 777 "��4"
              3⤵
                PID:364
              • bin/watchdog�þ
                "bin/watchdog�þ"
                3⤵
                  PID:365

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads