Analysis
- max time network
185s - platform
ubuntu-24.04_amd64 - resource
ubuntu2404-amd64-20240523-en - resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system - submitted
07/06/2024, 08:01
Behavioral task
behavioral1
Sample
param (1)
Resource
ubuntu2404-amd64-20240523-en
1 signatures
150 seconds
General
- Target param (1)
- Size 9.4MB
- Sample240607-jwmbeaeb37
- SHA256 e2935cd4cc9dec8dcea577a7f09538bb936962b5d3d49c941899cda8757642ee
- MD5 612eb1c916972e93782f0e72ea05ca2d
- SHA1 e6eaa6f09368c5e1158a682fb34c411fbfffbe97
- SHA512 c08b1947b1328ebaa459cacd286b5f66f00ae6e29cab63eca1d7f7441e9ce3e9b742a2581ddf1db2cbaa608a0d3e77e396b8843aa198e1333c969778c0493d1e
- SSDEEP 196608:DVbtR3sB8VbtR3sB8VbtR3sB8VbtR3sB8VbtR3sBi:DVbtR48VbtR48VbtR48VbtR48VbtR4i
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Looks up external IP address via web service 14 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 whatismyip.akamai.com 17 myip.dnsomatic.com 24 myexternalip.com 3 icanhazip.com 6 checkip.amazonaws.com 14 checkip.amazonaws.com 9 myip.dnsomatic.com 16 whatismyip.akamai.com 21 icanhazip.com 15 ident.me 4 myexternalip.com 7 ident.me 11 icanhazip.com 12 myexternalip.com