Analysis
-
max time kernel
152s -
max time network
155s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
-
submitted
20-12-2023 01:34
General
-
Target
78fff3620561ec9b1bdaf431cbc2aaed
-
Size
189KB
-
MD5
78fff3620561ec9b1bdaf431cbc2aaed
-
SHA1
8a3b13e0ecbe307e0d20b8654f1997143f0d2145
-
SHA256
60a993a128dce78272941b21f431c35c3458891d29d8a1e477836c3d4b71afd7
-
SHA512
54762b806d4aa9177c893daf64c7e15f691a54e6a0c692de4d5bf631c757b10d24b2d2be301cf149fef2588d4de1193b5bbd5beefc6bcc96ffd2bb8bbc09f2e7
-
SSDEEP
3072:B37SYpLA0FJWsGOcriwPuaBakNORuDe+WShh0uKbRPVkHNajzHWSPWMzZ2wBhiEq:huY+uaBakNOADechLKbAAjzHpBhiEdTQ
Score
9/10
Malware Config
Signatures
-
Contacts a large (6890) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/78fff3620561ec9b1bdaf431cbc2aaed/tmp/78fff3620561ec9b1bdaf431cbc2aaed1⤵
- Changes its process name
- Reads system routing table
- Reads system network configuration
- Reads runtime system information