3c50ef708fd72b96187e91c30cd80fb3eddd8cc6530e1e81dfaefbe6bc50ef34 | Triage

Analysis

max time kernel
150s
max time network
106s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
16-09-2024 13:50

Sharing

Report Analysis Logs

General

Target

04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
Size

371KB
MD5

2b9c8949f8a38de75f7c692d7d768591
SHA1

328d235e38f05b97eadfba5b3aa27826cbb4af66
SHA256

04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf
SHA512

e7bdbe98af08501b35ecedaceb2707d4079e5cae62d00161d67328f82e51fa34b3dc94c274596acaad021c1f2db572d991951e63260e294d403c04a8d74f7c34
SSDEEP

6144:pyZjxSZjEVdlcV5r2rjJUfJakVtj+Lp7R+0KoaGB068E4Xn6LFnnP1Iw2Q8TDpBX:pq9lcV5inJ0EkLjCpV+0KoaGBp/4Xn6S

Score

7^/10

discovery

Malware Config

Signatures

Creates Raw socket 1 IoCs

Creates a socket that captures raw packets at the device level

pid
790

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

description	ioc	Process
File opened for modification	/etc/resolv.conf	python2

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

Internet Connection Discovery

description	ioc	Process
File opened for reading	/proc/net/route	python2

Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	python2

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

Internet Connection Discovery

description	ioc	Process
File opened for reading	/proc/net/arp	python2
File opened for reading	/proc/net/route	python2

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/status	python2
File opened for reading	/proc/mounts	python2

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown	python2
File opened for modification	/tmp/.. /.logbackups	python2

/tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
/tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
1⤵
PID:711

/usr/local/sbin/python2
python2 /tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
1⤵
PID:711

/usr/local/bin/python2
python2 /tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
1⤵
PID:711

/usr/sbin/python2
python2 /tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
1⤵
PID:711

/usr/bin/python2
python2 /tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
1⤵
- Writes DNS configuration
- Reads system routing table
- Reads CPU attributes
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:711
- /sbin/ldconfig
  /sbin/ldconfig -p
  2⤵
  PID:737
- /bin/sh
  sh -c "uname -p 2> /dev/null"
  2⤵
  PID:789
- - /bin/uname
    uname -p
    3⤵
    PID:791

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Adversary-in-the-Middle

Discovery

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Adversary-in-the-Middle

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/.. /.logbackups

Filesize
3B

MD5
4e0928de075538c593fbdabb0c5ef2c3

SHA1
66c4d1ec6dadbb7073bb7c5132e479ca4d2b59cf

SHA256
089ee14b926fabea6dd95890032d1a37e69c1011c710977af774ec3a7b5b39a6

SHA512
a6af90d8e320c9c1162a765b066fc18ae1bcf35c596285f11584664b5fd96d1fda699319bb1f5f76257a6df11101e97ed1c9fd771687e7ee02a962b0ef40fb1a

Download Submit