Overview

overview

6

Static

static

3

DDoS-Rippe...per.py

ubuntu-20.04-amd64

6

DDoS-Rippe...t__.py

ubuntu-20.04-amd64

3

DDoS-Rippe...38.pyc

ubuntu-20.04-amd64

DDoS-Rippe...rm.dll

ubuntu-20.04-amd64

Resubmissions

08/09/2024, 09:49

240908-ltpd4aygpj6

07/09/2024, 21:53

240907-1rsq3axcrn3

07/09/2024, 21:50

240907-1qbq6axckp3

07/09/2024, 21:47

240907-1nltcazblh6

07/09/2024, 21:46

240907-1mtskazbja3

07/09/2024, 21:44

240907-1lm9dszalh6

07/09/2024, 21:41

240907-1jybksyhpc8

Analysis

  • max time kernel
    0s
  • max time network
    145s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    07/09/2024, 21:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DDoS-Ripper Pro/DRipper.py
  • Size 47KB
  • Sample240907-1nltcazblh
  • SHA256 2f8ffe7521b02a75326cbd70a1783294809fb0c6e3f6a02af72bdc86bf1d7b36
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10
discovery

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /usr/bin/python
    python "/tmp/DDoS-Ripper Pro/DRipper.py"
    1⤵
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1397
    • /bin/sh
      sh -c "uname -p 2> /dev/null"
      2⤵
        PID:1398
        • /usr/bin/uname
          uname -p
          3⤵
            PID:1399

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads