623f61b724de0bdbbe148f6878f0c534b1b066dc77af69e8c1da11c9e06f9d4c

Resubmissions

04-10-2024 09:37

241004-llngts1dpa 4

04-10-2024 09:30

241004-lgyf8s1cjb 4

04-10-2024 09:06

241004-k28x2azdlc 7

Analysis

max time kernel
148s
max time network
169s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
04-10-2024 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

meow.arm7
Size

171KB
MD5

9723e763c912093d46d718c88f2461ce
SHA1

804936aa9b7b7217b05f8f180f2b665f8bbc5ab1
SHA256

623f61b724de0bdbbe148f6878f0c534b1b066dc77af69e8c1da11c9e06f9d4c
SHA512

bd69996ab8dd98de467b0648ca613787208156a2b3bf8de031b210cb7ba5bd5d1710f7fa9fdc5957852f8eef6470932979ee9405b674c6da1b5765eb92606c3f
SSDEEP

3072:v+epvhpexB/Qr/fpi+2KhmhCQpa2wTr7+VUO1p7qM/9hOIZxvM:GKPF/fpi+2m8CQpaLyVUO1p+M/9MIo

Score

7^/10

Malware Config

Signatures

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	185.85.15.34
Destination IP	4.2.2.1
Destination IP	208.67.222.222
Destination IP	4.2.2.1
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	180.76.76.76
Destination IP	4.2.2.1
Destination IP	9.9.9.9
Destination IP	180.76.76.76
Destination IP	208.67.220.220
Destination IP	4.2.2.1
Destination IP	208.67.222.222
Destination IP	185.85.15.34
Destination IP	180.76.76.76
Destination IP	180.76.76.76
Destination IP	4.2.2.1
Destination IP	9.9.9.9
Destination IP	185.85.15.34
Destination IP	208.67.220.220
Destination IP	9.9.9.9
Destination IP	4.2.2.1
Destination IP	185.85.15.34
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	4.2.2.1
Destination IP	180.76.76.76
Destination IP	185.85.15.34
Destination IP	180.76.76.76
Destination IP	180.76.76.76
Destination IP	9.9.9.9
Destination IP	185.85.15.34
Destination IP	185.85.15.34
Destination IP	180.76.76.76
Destination IP	185.85.15.34
Destination IP	180.76.76.76
Destination IP	4.2.2.1
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	4.2.2.1
Destination IP	9.9.9.9
Destination IP	9.9.9.9
Destination IP	208.67.222.222
Destination IP	9.9.9.9
Destination IP	9.9.9.9
Destination IP	180.76.76.76
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	9.9.9.9
Destination IP	185.85.15.34
Destination IP	9.9.9.9
Destination IP	9.9.9.9
Destination IP	208.67.220.220
Destination IP	180.76.76.76
Destination IP	4.2.2.1
Destination IP	9.9.9.9
Destination IP	4.2.2.1
Destination IP	208.67.220.220
Destination IP	185.85.15.34
Destination IP	208.67.220.220
Destination IP	180.76.76.76

Changes its process name 1 IoCs

Processes:

meow.arm7

description ioc pid process

Changes the process name, possibly in an attempt to hide itself /bin/sh 1761 meow.arm7

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads