49290f83b42d99c5314f8bf07479509cc69fbf20586c1e5826fc739e6ad0889a

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20250307-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20250307-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
19/03/2025, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

isots
Size

154KB
MD5

d31d945767dd5a51e78ff0069533635f
SHA1

64665a224f472b07778819f38ff5a300c1712eeb
SHA256

7af5f6cda055b65e31298fe20ed4456a87d2ca92803552bc0d3422f0e1a1fda1
SHA512

8efeb8df05338abbd4305fc48914a91012edc91c2f6423ba59f4e54303c867dc7c5723ee94ade118585aa6965cc888558e699533f4f9d5eeb22e45c57634a628
SSDEEP

1536:lVVZidyDSsOKijSMQHiubRaPuFzbCPopEjApaSH0YnYHAznwfoORW3yfrEjucVBF:fidyKKijokmQPHcpaSHyftW3XUsNTf

Score

6^/10

discovery

Malware Config

Signatures

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	isots

Reads system network configuration 1 TTPs 19 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	isots
File opened for reading	/proc/net/sctp6/eps	isots
File opened for reading	/proc/net/sctp6/assocs	isots
File opened for reading	/proc/net/udplite	isots
File opened for reading	/proc/net/raw	isots
File opened for reading	/proc/net/unix	isots
File opened for reading	/proc/net/sctp/eps	isots
File opened for reading	/proc/net/udp	isots
File opened for reading	/proc/net/ax25	isots
File opened for reading	/proc/net/nr	isots
File opened for reading	/proc/net/udp6	isots
File opened for reading	/proc/net/udplite6	isots
File opened for reading	/proc/net/ipx/socket	isots
File opened for reading	/proc/net/ipx	isots
File opened for reading	/proc/net/rose	isots
File opened for reading	/proc/net/tcp6	isots
File opened for reading	/proc/net/sctp/assocs	isots
File opened for reading	/proc/net/raw6	isots
File opened for reading	/proc/net/x25	isots

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	isots

/tmp/isots
/tmp/isots
1⤵
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:2542

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads