Overview

overview

6

Static

static

1

ee3ca0782c...50436e

debian-9-armhf

6

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20231215-en
  • resource tags

    arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    22-12-2023 16:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ee3ca0782c9c594ecec8aa3b6850436e

  • Size

    977KB

  • MD5

    ee3ca0782c9c594ecec8aa3b6850436e

  • SHA1

    e3322025a73fc8cb259c8ff5750e1bc74aa323d7

  • SHA256

    00022640e5f6e96ed85c12bfad46fe54692b40dc58afe707dbfbaed6c5d46aa3

  • SHA512

    92463c51ab4ba1e65fe548768355242464481a04b139a6887dc4c634c82c754bd72d86a74a7323907c7c89f050145cc7cfd6e011eb40422c8cecb83713b808ea

  • SSDEEP

    12288:erXiRPpwBSHJB2A6f13P5D79dmuxlNzJs4dm3yxiD1WjfGAIFDFvyq766PdyYTQ0:jvwlP5DJdrRJsskWU5RPda2ByWwK3R

Score
6/10

Malware Config

Signatures

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 7 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/ee3ca0782c9c594ecec8aa3b6850436e
    /tmp/ee3ca0782c9c594ecec8aa3b6850436e
    1⤵
      PID:657
      • /bin/sh
        sh -c "sed -i -e '/exit/d' /etc/rc.local"
        2⤵
          PID:658
          • /bin/sed
            sed -i -e /exit/d /etc/rc.local
            3⤵
            • Reads runtime system information
            PID:659
        • /bin/sh
          sh -c "sed -i -e '/^ | | \$/d' /etc/rc.local"
          2⤵
            PID:661
            • /bin/sed
              sed -i -e "/^ | | \$/d" /etc/rc.local
              3⤵
              • Reads runtime system information
              PID:667
          • /bin/sh
            sh -c "sed -i -e '/ee3ca0782c9c594ecec8aa3b6850436e reboot/d' /etc/rc.local"
            2⤵
              PID:668
              • /bin/sed
                sed -i -e "/ee3ca0782c9c594ecec8aa3b6850436e reboot/d" /etc/rc.local
                3⤵
                • Reads runtime system information
                PID:670
            • /bin/sh
              sh -c "sed -i -e '2 i/tmp/ee3ca0782c9c594ecec8aa3b6850436e reboot' /etc/rc.local"
              2⤵
                PID:672
                • /bin/sed
                  sed -i -e "2 i/tmp/ee3ca0782c9c594ecec8aa3b6850436e reboot" /etc/rc.local
                  3⤵
                  • Reads runtime system information
                  PID:674
              • /bin/sh
                sh -c "sed -i -e '2 i/tmp/ee3ca0782c9c594ecec8aa3b6850436e reboot start' /etc/rc.d/rc.local"
                2⤵
                  PID:675
                  • /bin/sed
                    sed -i -e "2 i/tmp/ee3ca0782c9c594ecec8aa3b6850436e reboot start" /etc/rc.d/rc.local
                    3⤵
                    • Reads runtime system information
                    PID:677
                • /bin/sh
                  sh -c "sed -i -e '2 i/tmp/ee3ca0782c9c594ecec8aa3b6850436e reboot start' /etc/init.d/boot.local"
                  2⤵
                    PID:678
                    • /bin/sed
                      sed -i -e "2 i/tmp/ee3ca0782c9c594ecec8aa3b6850436e reboot start" /etc/init.d/boot.local
                      3⤵
                      • Reads runtime system information
                      PID:679

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads