1feebe88d742622b736541730e17c0141f223dc669e9894b7ddafaf870b1f898

Analysis

max time network
152s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/06/2024, 01:05

Target
1feebe88d742622b736541730e17c0141f223dc669e9894b7ddafaf870b1f898.elf
Size 57KB
Sample240613-bfnwassbpm
SHA256 1feebe88d742622b736541730e17c0141f223dc669e9894b7ddafaf870b1f898
MD5 20db31488ce976fc43e894daa0329c63
SHA1 eb0390223e8c451df5206a5e74187921539db624
SHA512 afd5e1aeaca0628c2335d85edb0df140ada0cdfcc3ad997d521fa370079e402eebe2c29be0eb65796b71fb4caa7e24ef8f65c814388cbe9031f13e697960cc36
SSDEEP 1536:+yXilUe1lsu4Zitmvi4+NmpcV5GpxXPtp:zEYatmvil5eXPD
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery

Contacts a large (75097) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	116.203.104.203

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact