3c50ef708fd72b96187e91c30cd80fb3eddd8cc6530e1e81dfaefbe6bc50ef34 | Triage

Analysis

max time kernel
123s
max time network
160s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
16-09-2024 19:27

Sharing

Report Analysis Logs

General

Target

04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
Size

371KB
MD5

2b9c8949f8a38de75f7c692d7d768591
SHA1

328d235e38f05b97eadfba5b3aa27826cbb4af66
SHA256

04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf
SHA512

e7bdbe98af08501b35ecedaceb2707d4079e5cae62d00161d67328f82e51fa34b3dc94c274596acaad021c1f2db572d991951e63260e294d403c04a8d74f7c34
SSDEEP

6144:pyZjxSZjEVdlcV5r2rjJUfJakVtj+Lp7R+0KoaGB068E4Xn6LFnnP1Iw2Q8TDpBX:pq9lcV5inJ0EkLjCpV+0KoaGBp/4Xn6S

Score

7^/10

discovery

Malware Config

Signatures

Creates Raw socket 1 IoCs

Creates a socket that captures raw packets at the device level

pid
783

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

description	ioc	Process
File opened for modification	/etc/resolv.conf	python2

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

Internet Connection Discovery

description	ioc	Process
File opened for reading	/proc/net/route	python2

Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	python2

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

Internet Connection Discovery

description	ioc	Process
File opened for reading	/proc/net/arp	python2
File opened for reading	/proc/net/route	python2

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/status	python2
File opened for reading	/proc/mounts	python2

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown	python2
File opened for modification	/tmp/.. /.logbackups	python2

/tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
/tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
1⤵
PID:704

/usr/local/sbin/python2
python2 /tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
1⤵
PID:704

/usr/local/bin/python2
python2 /tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
1⤵
PID:704

/usr/sbin/python2
python2 /tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
1⤵
PID:704

/usr/bin/python2
python2 /tmp/04d136f4c2bac4196b1795bcd9e625029d686c696e7decabd17970da22a35caf.unknown
1⤵
- Writes DNS configuration
- Reads system routing table
- Reads CPU attributes
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:704
- /sbin/ldconfig
  /sbin/ldconfig -p
  2⤵
  PID:731
- /bin/sh
  sh -c "uname -p 2> /dev/null"
  2⤵
  PID:784
- - /bin/uname
    uname -p
    3⤵
    PID:785

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Adversary-in-the-Middle

Discovery

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Adversary-in-the-Middle

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/.. /.logbackups

Filesize
3B

MD5
7143d7fbadfa4693b9eec507d9d37443

SHA1
c7e47b848aa68e937064a4420912fd41492a96fd

SHA256
28955b1fb53203e2ff246fd2d4c3e148d4666a617469cdcc86060985682ab4bc

SHA512
fc0b8b3a8786ff1a3fa9a9f2152dd4fa413c67ee4379a4b718a852c242b61c13dec202c8017f9d23c91d9e1b8c27d973caecf7d4c5a538112ae260e7910b312b

Download Submit