3ef8bb1d645223deb465bfdb08638db1fe1a804911a47f0d7f3863e412e87627

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/09/2024, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DsE-0.6.0-pc/DsE.py
Size

8KB
MD5

802e9dc460788d791f26a928765d879a
SHA1

4018620d40e8ec4f2ac3942f1d01dc3969853b0e
SHA256

5b6b977565179d1f2b49ea3dc6e5433121f72be8e35202e8c80d68455532d7f9
SHA512

03abfb71a3e670977c0da587aa04b53b422750f8c94bb45988e06f51a291a19921a8fb93bf013ef1910e756fea223363de9e8bd000408f44ff4971d54c885ee8
SSDEEP

192:7M1dwQHjiJqdt2RqEq1ShhKBqMJx45KB/H/osX3qzbFsqLdx+aHv8UTri:7NKiwdtzvMhhVMJ2KNf9XatLn+A0H

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: Python 1 TTPs 4 IoCs

Execution via Python.

execution

Python

T1059.006

pid	Process
752	python
752	python
752	python
752	python

/tmp/DsE-0.6.0-pc/DsE.py
/tmp/DsE-0.6.0-pc/DsE.py
1⤵
PID:752

/usr/local/sbin/python
python /tmp/DsE-0.6.0-pc/DsE.py
1⤵
- Command and Scripting Interpreter: Python
PID:752

/usr/local/bin/python
python /tmp/DsE-0.6.0-pc/DsE.py
1⤵
- Command and Scripting Interpreter: Python
PID:752

/usr/sbin/python
python /tmp/DsE-0.6.0-pc/DsE.py
1⤵
- Command and Scripting Interpreter: Python
PID:752

/usr/bin/python
python /tmp/DsE-0.6.0-pc/DsE.py
1⤵
- Command and Scripting Interpreter: Python
PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Python

T1059.006

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...