3c50ef708fd72b96187e91c30cd80fb3eddd8cc6530e1e81dfaefbe6bc50ef34

Analysis

max time kernel
150s
max time network
151s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
16-09-2024 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
Size

371KB
MD5

2b9c8949f8a38de75f7c692d7d768591
SHA1

328d235e38f05b97eadfba5b3aa27826cbb4af66
SHA256

04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf
SHA512

e7bdbe98af08501b35ecedaceb2707d4079e5cae62d00161d67328f82e51fa34b3dc94c274596acaad021c1f2db572d991951e63260e294d403c04a8d74f7c34
SSDEEP

6144:pyZjxSZjEVdlcV5r2rjJUfJakVtj+Lp7R+0KoaGB068E4Xn6LFnnP1Iw2Q8TDpBX:pq9lcV5inJ0EkLjCpV+0KoaGBp/4Xn6S

Score

7^/10

discovery

Malware Config

Signatures

Creates Raw socket 1 IoCs
Creates a socket that captures raw packets at the device level

Processes:

pid

772
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.

Adversary-in-the-Middle
T1557

Processes:

python2

description ioc process

File opened for modification /etc/resolv.conf python2
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
discovery

Internet Connection Discovery
T1016.001

Processes:

python2

description ioc process

File opened for reading /proc/net/route python2
Reads CPU attributes 1 TTPs 1 IoCs
discovery

System Information Discovery
T1082

Processes:

python2

description ioc process

File opened for reading /sys/devices/system/cpu/online python2
Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
discovery

Internet Connection Discovery
T1016.001

Processes:

python2

description ioc process

File opened for reading /proc/net/arp python2
File opened for reading /proc/net/route python2
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
discovery

Processes:

python2

description ioc process

File opened for reading /proc/self/status python2
File opened for reading /proc/mounts python2

pid
772

description	ioc	process
File opened for modification	/etc/resolv.conf	python2

description	ioc	process
File opened for reading	/proc/net/route	python2

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	python2

description	ioc	process
File opened for reading	/proc/net/arp	python2
File opened for reading	/proc/net/route	python2

description	ioc	process
File opened for reading	/proc/self/status	python2
File opened for reading	/proc/mounts	python2

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

Processes:

python2

description	ioc	process
File opened for modification	/tmp/.. /.logbackups	python2
File opened for modification	/tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown	python2

/tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
/tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
1⤵
PID:693

/usr/local/sbin/python2
python2 /tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
1⤵
PID:693

/usr/local/bin/python2
python2 /tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
1⤵
PID:693

/usr/sbin/python2
python2 /tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
1⤵
PID:693

/usr/bin/python2
python2 /tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
1⤵
- Writes DNS configuration
- Reads system routing table
- Reads CPU attributes
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:693
- /sbin/ldconfig
  /sbin/ldconfig -p
  2⤵
  PID:721
- /bin/sh
  sh -c "uname -p 2> /dev/null"
  2⤵
  PID:773
- - /bin/uname
    uname -p
    3⤵
    PID:774

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Adversary-in-the-Middle

T1557

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/.. /.logbackups

Filesize
3B

MD5
959a557f5f6beb411fd954f3f34b21c3

SHA1
581a8ed69cf5d505b989c438becd65e37c8de61e

SHA256
04222ea3e14cb1209b9726defe3efce5196b7afa0a959854a30401be41f4026d

SHA512
6a2482321ead10c19ca049aba9699b63db45ddb4da3913a2e537862761342dcd400e369b8a1471e19be1602362e6223af2be7ac116b0e13e927c52853e5d3f61

Download Submit