d2bf8b520b4e15637470d230088174b82c05be911f898042d805e9faabc78664

Analysis

max time kernel
152s
max time network
157s
platform
debian-9_armhf
resource
debian9-armhf-20231215-en
resource tags

arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19/12/2023, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5cad51361db3819636317b6572445725
Size

167KB
MD5

5cad51361db3819636317b6572445725
SHA1

f51dee5ce7a69a8396e2e7b9c438d1cc9cf36a8d
SHA256

d2bf8b520b4e15637470d230088174b82c05be911f898042d805e9faabc78664
SHA512

2305b3a59f88f0b8786108f04ea2354f1b5e77b03fad80c59a7ffd9485cbd6026d5a57ee0f170efa51637c38e9b0715de1ccd65290a7ecc2f22e884dd9803ddd
SSDEEP

3072:4EG+Twx0FyQfEz4ZavljwybAg72NxRNDkkZuAjW1Qtge5Is:4z20zQaNjF52NfFZuAW1Qtge5Is

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (117312) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	6IoZfk2ZrRbAMLfe5m2b	678	5cad51361db3819636317b6572445725

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/route	5cad51361db3819636317b6572445725

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/route	5cad51361db3819636317b6572445725

/tmp/5cad51361db3819636317b6572445725
/tmp/5cad51361db3819636317b6572445725
1⤵
- Changes its process name
- Reads system routing table
- Reads system network configuration
PID:678

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads