Analysis
-
max time kernel
38840s -
max time network
154s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
-
submitted
03/03/2023, 05:36
General
-
Target
bok.x86
-
Size
65KB
-
MD5
445b6a195b6f4a020b46abb0238fb202
-
SHA1
ac3570d2e7f583d106ddc53015b6a6e851320f0f
-
SHA256
4ab8429c75ae119098a20480350e3d8d4d59fb3d0a46bbb11ac9f28bf1f70411
-
SHA512
0a43e0de4e36c946538fe21357865f901e88e85a693bb42f77c16fc05bc291785ec28dbe2ca8d8febe4003dd52b012009eb701e01e43a9853931ac999ab36ee9
-
SSDEEP
1536:WgafdCLPcm8TQ/h/+ggp/KtGYsPgw7JoifHY6:WgaViPcVT2YglUYmLP/Y
Score
9/10
Malware Config
Signatures
-
Contacts a large (46704) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/bok.x86/tmp/bok.x861⤵
- Writes file to tmp directory