Analysis
-
max time kernel
153s -
max time network
148s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
22-12-2023 05:21
Static task
static1
Behavioral task
behavioral1
Sample
70e553bfcfc05ba25fa7f8032d290aff
Resource
ubuntu1804-amd64-20231215-en
General
-
Target
70e553bfcfc05ba25fa7f8032d290aff
-
Size
1.4MB
-
MD5
70e553bfcfc05ba25fa7f8032d290aff
-
SHA1
07c9687a9f1577282c177279f6f09f952f3bc97a
-
SHA256
00c65c934d39acd0e1e48bbdc5f559eeaaa786fad02efdb29ed1ea94db644e24
-
SHA512
f0c08b322e9866d6307e89f051508553c2f28415363d85f59662dafde94749d13dbcbc3a089b39a4a9bebf214f0d3a43b03ee721cc1b5b31e07cbd6e7682d502
-
SSDEEP
24576:i6tcmqGp0fQfhrx7YfiUbDqYCsQQmx2/IVFvZGuOl9UgfmeRq6FFIvwRlrUa:i/RQ5x7GiUbD9ChZGuOlBAJGUa
Malware Config
Signatures
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc File opened for reading /proc/cpuinfo -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/dev -
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/stat -
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc File opened for modification /tmp/dlcfg File opened for modification /tmp/fake.cfg
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD504e37ac056fe5668cea6453df273a7b0
SHA1f8d9bc73577429d14321a9d25bb433880d174a93
SHA256643e6dea9ba8832fee4a46afccf37faa646efb9bd6100582b46b2b13ef29c0b0
SHA5127c5a75c077f23d83224d7ceef269a12bbf5210e2d079b3f2539ffee3091fd30d4b4496a4368688f080e626cf9158fef9b5bebb6d6ec82dba516de470ea24a0bd
-
Filesize
43B
MD56558809eccff552c393070a603fa5c9b
SHA13a43eed50b587bbaa038d8f1b7085f03d367f43c
SHA256fdb29b7c4b2d0f6c344cc8bcbd695fd3b0f84a939123663bbf06a2c2dea67781
SHA5127d369ebd66ecc3ad4a6572d30e3fcd0863dc1de7d2085d8839e66bfb9e106f575842f356fefc1bbf79ae57d13546c4d82c29246e6ef645031159d68b0fe76927