Overview
overview
10Static
static
10void/0394b...43.exe
windows7-x64
3void/0394b...43.exe
windows10-2004-x64
3void/0aa21...0f.elf
ubuntu-24.04-amd64
1void/250bb...13.exe
windows7-x64
6void/250bb...13.exe
windows10-2004-x64
6void/257ff...b4.exe
windows7-x64
1void/257ff...b4.exe
windows10-2004-x64
8void/37208...92.elf
debian-9-mips
7void/43958...0d.exe
windows7-x64
10void/43958...0d.exe
windows10-2004-x64
10void/469a3...1b.ps1
windows7-x64
10void/469a3...1b.ps1
windows10-2004-x64
10void/5a099...8b.exe
windows7-x64
1void/5a099...8b.exe
windows10-2004-x64
1void/72cb9...de.elf
ubuntu-22.04-amd64
10void/73055...90.exe
windows7-x64
3void/73055...90.exe
windows10-2004-x64
3การ�...��.exe
windows7-x64
8การ�...��.exe
windows10-2004-x64
8void/7ac64...d2.exe
windows7-x64
1void/7ac64...d2.exe
windows10-2004-x64
8void/7b380...cc.dmg
macos-10.15-amd64
1Brew/Brew
macos-10.15-amd64
4void/7dec8...a.html
windows7-x64
3void/7dec8...a.html
windows10-2004-x64
3void/80e6e...e3.exe
windows7-x64
3void/80e6e...e3.exe
windows10-2004-x64
3void/82231...6b.exe
windows7-x64
1void/82231...6b.exe
windows10-2004-x64
8void/8732e...71.exe
windows7-x64
1void/8732e...71.exe
windows10-2004-x64
8void/8c55a...97.elf
debian-9-mipsel
7Analysis
-
max time kernel
14s -
max time network
32s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
20/03/2025, 20:09
Behavioral task
behavioral1
Sample
void/0394b475234ecc6f752ecdd9f7e5ea28cebe404e5db6a8cf2f9019915c4ddf43.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
void/0394b475234ecc6f752ecdd9f7e5ea28cebe404e5db6a8cf2f9019915c4ddf43.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
void/0aa210086ab837dea1a26dd45a661f7f78ea90d243c6fad74cd4772325bff20f.elf
Resource
ubuntu2404-amd64-20250307-en
ubuntu-24.04-amd64
Behavioral task
behavioral4
Sample
void/250bb552893533d2e47ca18faa6f3026495d47bae799046c07749726f2f9c213.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral5
Sample
void/250bb552893533d2e47ca18faa6f3026495d47bae799046c07749726f2f9c213.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
void/257ffa778469d570082f7cfff1ad199a9bffffc278e9c012bea17d02393b95b4.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral7
Sample
void/257ffa778469d570082f7cfff1ad199a9bffffc278e9c012bea17d02393b95b4.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
void/3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral9
Sample
void/43958be574c6a890961e38fa91710b15261d9b388d08c2b899219886f2ab710d.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
void/43958be574c6a890961e38fa91710b15261d9b388d08c2b899219886f2ab710d.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
void/469a30082aeff1c7367a5c98d83d4230947500771e86738903a026859f870f1b.ps1
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
void/469a30082aeff1c7367a5c98d83d4230947500771e86738903a026859f870f1b.ps1
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
void/5a099db04b83c828b23e283d7bead0eed7e6c2e415a2632d5546bf776a54ac8b.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
void/5a099db04b83c828b23e283d7bead0eed7e6c2e415a2632d5546bf776a54ac8b.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
void/72cb96390164439710b0ab64f8b0e211d49875a0f4ea402da22a0269794891de.elf
Resource
ubuntu2204-amd64-20250307-en
ubuntu-22.04-amd64
Behavioral task
behavioral16
Sample
void/7305516a3c2ef76a10be8dc65d0de1d446ad157abd51e84a2e0f3979fc6c4490.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral17
Sample
void/7305516a3c2ef76a10be8dc65d0de1d446ad157abd51e84a2e0f3979fc6c4490.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
การชำระเงินครั้งสุดท้าย.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
การชำระเงินครั้งสุดท้าย.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
void/7ac644fc3b59f9ae6995a9cc57c39aee97ac89b3d25652c29c9a3269a02db2d2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
void/7ac644fc3b59f9ae6995a9cc57c39aee97ac89b3d25652c29c9a3269a02db2d2.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
void/7b380357933497fe52439da94472b6cc7564fe5c852def28d4843c1a15792bcc.dmg
Resource
macos-20241101-en
macos-10.15-amd64
Behavioral task
behavioral23
Sample
Brew/Brew
Resource
macos-20241106-en
macos-10.15-amd64
Behavioral task
behavioral24
Sample
void/7dec88c2ec34b8483abc44e98ec843877cc5ae88e094c90d46bbabfafdf3749a.html
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral25
Sample
void/7dec88c2ec34b8483abc44e98ec843877cc5ae88e094c90d46bbabfafdf3749a.html
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
void/80e6e20e66c60f7392af8f501b07f8a10893f8c426acd6bdb42ea50738e6fae3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
void/80e6e20e66c60f7392af8f501b07f8a10893f8c426acd6bdb42ea50738e6fae3.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
void/82231216bb55678a4bc192c1f0f180121ffc0a6278dcd1d6d9db8bea784ccf6b.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral29
Sample
void/82231216bb55678a4bc192c1f0f180121ffc0a6278dcd1d6d9db8bea784ccf6b.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
void/8732ecc7dd6bb49a644d7ca3edadd316657b2508a013da09db0f5b3c5c036c71.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral31
Sample
void/8732ecc7dd6bb49a644d7ca3edadd316657b2508a013da09db0f5b3c5c036c71.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
void/8c55a86afc661db10bbe1a1d2ab249a5b30fc1fe4b6738ad3ed69546ea045897.elf
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
General
-
Target
void/3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf
-
Size
898KB
-
MD5
743c87a17820edb35edbe6611d5473bd
-
SHA1
c1554bbd9a724412b94b9694c073c85a68ab0d1c
-
SHA256
3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92
-
SHA512
98e5585d9bcc962111fca65d945a2aafd1bb870cfd9057d089c773e0e6c45241842bb83ac3aa2678946c11813b6da59bdd549d36f1d5de3f934c7a73e12b800f
-
SSDEEP
12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplp:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khu
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 717 3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 3 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep -
Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
description ioc Process File opened for reading /proc/12/status pgrep File opened for reading /proc/70/status pgrep File opened for reading /proc/22/cmdline pgrep File opened for reading /proc/384/cmdline pidof File opened for reading /proc/77/cmdline pgrep File opened for reading /proc/374/status pgrep File opened for reading /proc/381/cmdline pgrep File opened for reading /proc/716/cmdline pgrep File opened for reading /proc/717/stat pidof File opened for reading /proc/75/status pgrep File opened for reading /proc/171/status pgrep File opened for reading /proc/396/status pgrep File opened for reading /proc/73/cmdline pidof File opened for reading /proc/81/cmdline pidof File opened for reading /proc/150/cmdline pidof File opened for reading /proc/81/cmdline pgrep File opened for reading /proc/357/cmdline pgrep File opened for reading /proc/111/stat pidof File opened for reading /proc/739/cmdline pgrep File opened for reading /proc/374/stat pidof File opened for reading /proc/13/status pgrep File opened for reading /proc/82/cmdline pgrep File opened for reading /proc/662/status pgrep File opened for reading /proc/715/status pgrep File opened for reading /proc/122/stat pidof File opened for reading /proc/73/stat pidof File opened for reading /proc/667/stat pidof File opened for reading /proc/720/cmdline pidof File opened for reading /proc/122/stat pidof File opened for reading /proc/686/cmdline pidof File opened for reading /proc/111/cmdline pgrep File opened for reading /proc/328/status pgrep File opened for reading /proc/7/cmdline pidof File opened for reading /proc/8/stat pidof File opened for reading /proc/396/cmdline pidof File opened for reading /proc/715/cmdline pidof File opened for reading /proc/354/cmdline pgrep File opened for reading /proc/381/stat pidof File opened for reading /proc/6/status pgrep File opened for reading /proc/20/cmdline pidof File opened for reading /proc/21/status pgrep File opened for reading /proc/14/stat pidof File opened for reading /proc/71/cmdline pidof File opened for reading /proc/20/status pgrep File opened for reading /proc/659/status pgrep File opened for reading /proc/687/status pgrep File opened for reading /proc/122/stat pidof File opened for reading /proc/662/stat pidof File opened for reading /proc/715/stat pidof File opened for reading /proc/324/cmdline pgrep File opened for reading /proc/381/cmdline pgrep File opened for reading /proc/223/stat pidof File opened for reading /proc/1/status pgrep File opened for reading /proc/23/stat pidof File opened for reading /proc/154/cmdline pidof File opened for reading /proc/396/cmdline pgrep File opened for reading /proc/720/status pgrep File opened for reading /proc/71/status pgrep File opened for reading /proc/154/stat pidof File opened for reading /proc/71/stat pidof File opened for reading /proc/667/cmdline pidof File opened for reading /proc/3/status pgrep File opened for reading /proc/154/status pgrep File opened for reading /proc/21/stat pidof
Processes
-
/tmp/void/3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf/tmp/void/3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf1⤵
- Deletes itself
PID:717 -
/bin/shsh -c "pgrep 3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf"2⤵PID:720
-
/usr/bin/pgreppgrep 3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf3⤵
- Reads CPU attributes
- Reads runtime system information
PID:721
-
-
-
/bin/shsh -c "pidof 3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf"2⤵PID:727
-
/bin/pidofpidof 3720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92.elf3⤵
- Reads runtime system information
PID:728
-
-
-
/bin/shsh -c "pgrep uplugplay"2⤵PID:731
-
/usr/bin/pgreppgrep uplugplay3⤵
- Reads CPU attributes
- Reads runtime system information
PID:732
-
-
-
/bin/shsh -c "pidof uplugplay"2⤵PID:735
-
/bin/pidofpidof uplugplay3⤵
- Reads runtime system information
PID:736
-
-
-
/bin/shsh -c "pgrep upnpsetup"2⤵PID:739
-
/usr/bin/pgreppgrep upnpsetup3⤵
- Reads CPU attributes
- Reads runtime system information
PID:740
-
-
-
/bin/shsh -c "pidof upnpsetup"2⤵PID:743
-
/bin/pidofpidof upnpsetup3⤵
- Reads runtime system information
PID:744
-
-
-
/bin/shsh -c "systemctl daemon-reload"2⤵PID:751
-
/bin/systemctlsystemctl daemon-reload3⤵
- Enumerates kernel/hardware configuration
PID:752
-
-
-
/bin/shsh -c "systemctl enable uplugplay.service"2⤵PID:779
-
/bin/systemctlsystemctl enable uplugplay.service3⤵
- Enumerates kernel/hardware configuration
PID:780
-
-
-
/bin/shsh -c "systemctl start uplugplay.service"2⤵PID:801
-
/bin/systemctlsystemctl start uplugplay.service3⤵
- Enumerates kernel/hardware configuration
PID:803
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD58ca62d1f47880bce036c2956c9b7b272
SHA13bcc3a5c4fcc5b0d08c4524a59f6b8e113b62060
SHA256c655d3d4e374fad38313ec4262207b2d7d68a870238f203ef3c33f85e66c8e32
SHA5124cd2d9d67151fa25e833707dee2442c4a5f752053fc2c36ec73c0e2b734c66ca69c63fceb47714d9add5b9fe2eee1e45be5199e2cae7c26173e766b333877da6
-
Filesize
898KB
MD5743c87a17820edb35edbe6611d5473bd
SHA1c1554bbd9a724412b94b9694c073c85a68ab0d1c
SHA2563720875269fee71bfa7b07171bc78dfedddd95d32ecf5bd7f2ade07035c25e92
SHA51298e5585d9bcc962111fca65d945a2aafd1bb870cfd9057d089c773e0e6c45241842bb83ac3aa2678946c11813b6da59bdd549d36f1d5de3f934c7a73e12b800f