Overview
overview
10Static
static
10void/0394b...43.exe
windows7-x64
3void/0394b...43.exe
windows10-2004-x64
3void/0aa21...0f.elf
ubuntu-18.04-amd64
1void/250bb...13.exe
windows7-x64
6void/250bb...13.exe
windows10-2004-x64
6void/257ff...b4.exe
windows7-x64
1void/257ff...b4.exe
windows10-2004-x64
8void/37208...92.elf
debian-9-mips
7void/43958...0d.exe
windows7-x64
10void/43958...0d.exe
windows10-2004-x64
10void/469a3...1b.ps1
windows7-x64
10void/469a3...1b.ps1
windows10-2004-x64
10void/5a099...8b.exe
windows7-x64
1void/5a099...8b.exe
windows10-2004-x64
1void/72cb9...de.elf
ubuntu-24.04-amd64
1void/73055...90.exe
windows7-x64
3void/73055...90.exe
windows10-2004-x64
3การ�...��.exe
windows7-x64
8การ�...��.exe
windows10-2004-x64
8void/7ac64...d2.exe
windows7-x64
1void/7ac64...d2.exe
windows10-2004-x64
8void/7b380...cc.dmg
macos-10.15-amd64
1Brew/Brew
macos-10.15-amd64
4void/7dec8...a.html
windows7-x64
3void/7dec8...a.html
windows10-2004-x64
3void/80e6e...e3.exe
windows7-x64
3void/80e6e...e3.exe
windows10-2004-x64
3void/82231...6b.exe
windows7-x64
1void/82231...6b.exe
windows10-2004-x64
8void/8732e...71.exe
windows7-x64
1void/8732e...71.exe
windows10-2004-x64
8void/8c55a...97.elf
debian-12-mipsel
7Analysis
-
max time kernel
16s -
max time network
26s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
20/03/2025, 20:07
Behavioral task
behavioral1
Sample
void/0394b475234ecc6f752ecdd9f7e5ea28cebe404e5db6a8cf2f9019915c4ddf43.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
void/0394b475234ecc6f752ecdd9f7e5ea28cebe404e5db6a8cf2f9019915c4ddf43.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
void/0aa210086ab837dea1a26dd45a661f7f78ea90d243c6fad74cd4772325bff20f.elf
Resource
ubuntu1804-amd64-20240729-en
ubuntu-18.04-amd64
Behavioral task
behavioral4
Sample
void/250bb552893533d2e47ca18faa6f3026495d47bae799046c07749726f2f9c213.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral5
Sample
void/250bb552893533d2e47ca18faa6f3026495d47bae799046c07749726f2f9c213.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
void/257ffa778469d570082f7cfff1ad199a9bffffc278e9c012bea17d02393b95b4.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral7
Sample
void/257ffa778469d570082f7cfff1ad199a9bffffc278e9c012bea17d02393b95b4.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
void/3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral9
Sample
void/43958be574c6a890961e38fa91710b15261d9b388d08c2b899219886f2ab710d.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
void/43958be574c6a890961e38fa91710b15261d9b388d08c2b899219886f2ab710d.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
void/469a30082aeff1c7367a5c98d83d4230947500771e86738903a026859f870f1b.ps1
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
void/469a30082aeff1c7367a5c98d83d4230947500771e86738903a026859f870f1b.ps1
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
void/5a099db04b83c828b23e283d7bead0eed7e6c2e415a2632d5546bf776a54ac8b.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral14
Sample
void/5a099db04b83c828b23e283d7bead0eed7e6c2e415a2632d5546bf776a54ac8b.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
void/72cb96390164439710b0ab64f8b0e211d49875a0f4ea402da22a0269794891de.elf
Resource
ubuntu2404-amd64-20250307-en
ubuntu-24.04-amd64
Behavioral task
behavioral16
Sample
void/7305516a3c2ef76a10be8dc65d0de1d446ad157abd51e84a2e0f3979fc6c4490.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
void/7305516a3c2ef76a10be8dc65d0de1d446ad157abd51e84a2e0f3979fc6c4490.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
การชำระเงินครั้งสุดท้าย.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
การชำระเงินครั้งสุดท้าย.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
void/7ac644fc3b59f9ae6995a9cc57c39aee97ac89b3d25652c29c9a3269a02db2d2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
void/7ac644fc3b59f9ae6995a9cc57c39aee97ac89b3d25652c29c9a3269a02db2d2.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
void/7b380357933497fe52439da94472b6cc7564fe5c852def28d4843c1a15792bcc.dmg
Resource
macos-20241101-en
macos-10.15-amd64
Behavioral task
behavioral23
Sample
Brew/Brew
Resource
macos-20241106-en
macos-10.15-amd64
Behavioral task
behavioral24
Sample
void/7dec88c2ec34b8483abc44e98ec843877cc5ae88e094c90d46bbabfafdf3749a.html
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral25
Sample
void/7dec88c2ec34b8483abc44e98ec843877cc5ae88e094c90d46bbabfafdf3749a.html
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
void/80e6e20e66c60f7392af8f501b07f8a10893f8c426acd6bdb42ea50738e6fae3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
void/80e6e20e66c60f7392af8f501b07f8a10893f8c426acd6bdb42ea50738e6fae3.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
void/82231216bb55678a4bc192c1f0f180121ffc0a6278dcd1d6d9db8bea784ccf6b.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral29
Sample
void/82231216bb55678a4bc192c1f0f180121ffc0a6278dcd1d6d9db8bea784ccf6b.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
void/8732ecc7dd6bb49a644d7ca3edadd316657b2508a013da09db0f5b3c5c036c71.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral31
Sample
void/8732ecc7dd6bb49a644d7ca3edadd316657b2508a013da09db0f5b3c5c036c71.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
void/8c55a86afc661db10bbe1a1d2ab249a5b30fc1fe4b6738ad3ed69546ea045897.elf
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
General
-
Target
void/3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf
-
Size
898KB
-
MD5
743c87a17820edb35edbe6611d5473bd
-
SHA1
c1554bbd9a724412b94b9694c073c85a68ab0d1c
-
SHA256
3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92
-
SHA512
98e5585d9bcc962111fca65d945a2aafd1bb870cfd9057d089c773e0e6c45241842bb83ac3aa2678946c11813b6da59bdd549d36f1d5de3f934c7a73e12b800f
-
SSDEEP
12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplp:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khu
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 751 3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 3 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep -
Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
description ioc Process File opened for reading /proc/69/status pgrep File opened for reading /proc/7/cmdline pidof File opened for reading /proc/81/stat pidof File opened for reading /proc/104/status pgrep File opened for reading /proc/72/cmdline pidof File opened for reading /proc/720/stat pidof File opened for reading /proc/726/stat pidof File opened for reading /proc/726/cmdline pidof File opened for reading /proc/359/cmdline pgrep File opened for reading /proc/744/cmdline pidof File opened for reading /proc/709/cmdline pgrep File opened for reading /proc/770/cmdline pgrep File opened for reading /proc/2/stat pidof File opened for reading /proc/3/cmdline pidof File opened for reading /proc/67/cmdline pidof File opened for reading /proc/69/stat pidof File opened for reading /proc/660/stat pidof File opened for reading /proc/320/cmdline pgrep File opened for reading /proc/748/cmdline pidof File opened for reading /proc/776/cmdline pgrep File opened for reading /proc/68/cmdline pidof File opened for reading /proc/74/cmdline pidof File opened for reading /proc/20/cmdline pgrep File opened for reading /proc/24/cmdline pidof File opened for reading /proc/5/cmdline pgrep File opened for reading /proc/75/status pgrep File opened for reading /proc/7/stat pidof File opened for reading /proc/14/stat pidof File opened for reading /proc/221/cmdline pidof File opened for reading /proc/11/status pgrep File opened for reading /proc/666/stat pidof File opened for reading /proc/72/stat pidof File opened for reading /proc/16/stat pidof File opened for reading /proc/726/status pgrep File opened for reading /proc/144/status pgrep File opened for reading /proc/721/cmdline pgrep File opened for reading /proc/749/cmdline pidof File opened for reading /proc/371/status pgrep File opened for reading /proc/37/status pgrep File opened for reading /proc/720/cmdline pidof File opened for reading /proc/69/cmdline pidof File opened for reading /proc/359/cmdline pgrep File opened for reading /proc/721/stat pidof File opened for reading /proc/22/status pgrep File opened for reading /proc/67/cmdline pidof File opened for reading /proc/69/stat pidof File opened for reading /proc/327/stat pidof File opened for reading /proc/14/stat pidof File opened for reading /proc/754/cmdline pgrep File opened for reading /proc/770/cmdline pidof File opened for reading /proc/74/cmdline pgrep File opened for reading /proc/75/stat pidof File opened for reading /proc/114/cmdline pidof File opened for reading /proc/236/stat pidof File opened for reading /proc/379/status pgrep File opened for reading /proc/776/status pgrep File opened for reading /proc/12/cmdline pidof File opened for reading /proc/766/cmdline pidof File opened for reading /proc/15/cmdline pgrep File opened for reading /proc/104/status pgrep File opened for reading /proc/328/cmdline pgrep File opened for reading /proc/17/cmdline pidof File opened for reading /proc/750/stat pidof File opened for reading /proc/373/status pgrep
Processes
-
/tmp/void/3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf/tmp/void/3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf1⤵
- Deletes itself
PID:751 -
/bin/shsh -c "pgrep 3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf"2⤵PID:754
-
/usr/bin/pgreppgrep 3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf3⤵
- Reads CPU attributes
- Reads runtime system information
PID:755
-
-
-
/bin/shsh -c "pidof 3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf"2⤵PID:762
-
/bin/pidofpidof 3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf3⤵
- Reads runtime system information
PID:763
-
-
-
/bin/shsh -c "pgrep uplugplay"2⤵PID:766
-
/usr/bin/pgreppgrep uplugplay3⤵
- Reads CPU attributes
- Reads runtime system information
PID:767
-
-
-
/bin/shsh -c "pidof uplugplay"2⤵PID:770
-
/bin/pidofpidof uplugplay3⤵
- Reads runtime system information
PID:771
-
-
-
/bin/shsh -c "pgrep upnpsetup"2⤵PID:774
-
/usr/bin/pgreppgrep upnpsetup3⤵
- Reads CPU attributes
- Reads runtime system information
PID:776
-
-
-
/bin/shsh -c "pidof upnpsetup"2⤵PID:792
-
/bin/pidofpidof upnpsetup3⤵
- Reads runtime system information
PID:793
-
-
-
/bin/shsh -c "systemctl daemon-reload"2⤵PID:808
-
/bin/systemctlsystemctl daemon-reload3⤵
- Enumerates kernel/hardware configuration
PID:809
-
-
-
/bin/shsh -c "systemctl enable uplugplay.service"2⤵PID:838
-
/bin/systemctlsystemctl enable uplugplay.service3⤵
- Enumerates kernel/hardware configuration
PID:839
-
-
-
/bin/shsh -c "systemctl start uplugplay.service"2⤵PID:853
-
/bin/systemctlsystemctl start uplugplay.service3⤵
- Enumerates kernel/hardware configuration
PID:854
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD58ca62d1f47880bce036c2956c9b7b272
SHA13bcc3a5c4fcc5b0d08c4524a59f6b8e113b62060
SHA256c655d3d4e374fad38313ec4262207b2d7d68a870238f203ef3c33f85e66c8e32
SHA5124cd2d9d67151fa25e833707dee2442c4a5f752053fc2c36ec73c0e2b734c66ca69c63fceb47714d9add5b9fe2eee1e45be5199e2cae7c26173e766b333877da6
-
Filesize
898KB
MD5743c87a17820edb35edbe6611d5473bd
SHA1c1554bbd9a724412b94b9694c073c85a68ab0d1c
SHA2563720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92
SHA51298e5585d9bcc962111fca65d945a2aafd1bb870cfd9057d089c773e0e6c45241842bb83ac3aa2678946c11813b6da59bdd549d36f1d5de3f934c7a73e12b800f