Analysis
-
max time network
154s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
28/05/2024, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
afcd4e300eab30a940cf4c062d60f994dc70100310d65ae97569927e3b0376ba.elf
Resource
debian9-armhf-20240226-en
General
-
Target
afcd4e300eab30a940cf4c062d60f994dc70100310d65ae97569927e3b0376ba.elf
-
Size
96KB
-
MD5
7f0edbd5c17774aace4d45dfb521dce6
-
SHA1
7f0e400ff01d3e0752b909a8979327c14e05395f
-
SHA256
afcd4e300eab30a940cf4c062d60f994dc70100310d65ae97569927e3b0376ba
-
SHA512
52c23cd6c8f3c6632f95c32be16eb101027491708b522f21c137ce13fdb2a80107602f6f6ad62ce71e1b4e43a91990d6e905d1e5c1faaeb8b563a07db8c472b6
-
SSDEEP
1536:vwnT+TU2RnsXNWM5lxwlvs99/TqKLK+zs3ItNhqN9lxJidpi/mWZxY5cuj:EmVheB5lx/TBLK+zs3ItWOpi/mWnlu
Malware Config
Signatures
-
Contacts a large (76761) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 130.61.64.122