30956e0fd53f8ca9cd852201dd649585ec9cecd8c34b9478f97529a1bfe3a1d6 | Triage

Analysis

max time kernel
9s
max time network
133s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231026-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231026-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
07/11/2023, 14:20

Sharing

Report Analysis Logs

General

Target

soldatserver
Size

411KB
MD5

1dba653582ab3beda162b81b779c6615
SHA1

43e12508f2926f7b9b34db1bb19e15dfa03e652f
SHA256

18bd8521fe857d8566a87e36f9e7dc455e1da5bfacda6667aeb31b12a959dc59
SHA512

daae164c554e8571f4bd9d8098e4ce72e39d8159a9d74bd4ef765d83486c3a1c70f89a7d647234e1ab5754b6dfc4fd6e8d589bf4ebedc638b67897ac30e675a2
SSDEEP

12288:b3DQyGqQs0wYuXg9mKITUvmpPijA12kaeibBr:b3VGq/jXgtIQepajeae8r

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/upxCFLP5GWABQH	1543	upxCFLP5GWABQH

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1543/exe	soldatserver

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/upxCFLP5GWABQH	soldatserver

/tmp/soldatserver
/tmp/soldatserver
1⤵
- Reads runtime system information
- Writes file to tmp directory
PID:1543

/proc/1543/fd/3
/tmp/soldatserver
1⤵
PID:1543

/tmp/upxCFLP5GWABQH
/tmp/soldatserver
1⤵
- Executes dropped EXE
PID:1543

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/upxCFLP5GWABQH

Filesize
975KB

MD5
da94920fffa4df70cc047a13f8a389cf

SHA1
37a7677b871d4c4902698a634454569664fe63a8

SHA256
547987a6df18f6c1566ecbb9d4f906a792890a79b62941651b7499385a8ac469

SHA512
aa6bee66995ad05a6e1f80c130d34bbfc8bd6fb0604c94e2da5e0a129f66b72f73e6c2e269d8e8a3d66ca48c140a125a57c7af189cedfa6d8df93600be186a65

Download Submit