195e559405a35b0509843beebcd67cb95bc3189ec0abfd823b15108a36d00a02

Analysis

max time kernel
0s
max time network
128s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
29-12-2024 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

i586.elf
Size

85KB
MD5

90df5aecf2e241b657515234c918814a
SHA1

2a7688a14981c891baafe8446d6f2be50243f72f
SHA256

195e559405a35b0509843beebcd67cb95bc3189ec0abfd823b15108a36d00a02
SHA512

486bc1a462a193682aa475da98b66c8d2c580dd0b20913908e5d80c0e493ee5cd3e0401e3755ff72451920f827cd55797f48c7c107150bded80307abd1280d0d
SSDEEP

1536:x4vE4juf0Uz+bzu0ZloupkqBYlww9k4cgtAPHa5hSIsG7she0QzUzJYQ2Wk:mvznUSbK0Qup0wak4rr5hS+7Ue0QzUFU

Score

7^/10

Malware Config

Signatures

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/resolv.conf	i586.elf

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1546	i586.elf

/tmp/i586.elf
/tmp/i586.elf
1⤵
- Writes DNS configuration
- Changes its process name
PID:1546

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Adversary-in-the-Middle

T1557

Discovery

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads