Analysis
- max time kernel
145s - max time network
153s - platform
debian-12_armhf - resource
debian12-armhf-20250619-en - resource tags
arch:armhfimage:debian12-armhf-20250619-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
04/11/2025, 15:21
Behavioral task
behavioral1
Sample
623f61b724de0bdbbe148f6878f0c534b1b066dc77af69e8c1da11c9e06f9d4c.bin
Resource
debian12-armhf-20250619-en
debian-12-armhf
2 signatures
150 seconds
General
- Target 623f61b724de0bdbbe148f6878f0c534b1b066dc77af69e8c1da11c9e06f9d4c.bin
- Size 171KB
- Sample251104-srmwtact6d
- SHA256 623f61b724de0bdbbe148f6878f0c534b1b066dc77af69e8c1da11c9e06f9d4c
- MD5 9723e763c912093d46d718c88f2461ce
- SHA1 804936aa9b7b7217b05f8f180f2b665f8bbc5ab1
- SHA512 bd69996ab8dd98de467b0648ca613787208156a2b3bf8de031b210cb7ba5bd5d1710f7fa9fdc5957852f8eef6470932979ee9405b674c6da1b5765eb92606c3f
- SSDEEP 3072:v+epvhpexB/Qr/fpi+2KhmhCQpa2wTr7+VUO1p7qM/9hOIZxvM:GKPF/fpi+2m8CQpaLyVUO1p+M/9MIo
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Unexpected DNS network traffic destination 59 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 185.85.15.34 Destination IP 208.67.222.222 Destination IP 4.2.2.1 Destination IP 9.9.9.9 Destination IP 4.2.2.1 Destination IP 180.76.76.76 Destination IP 185.85.15.34 Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 4.2.2.1 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 185.85.15.34 Destination IP 180.76.76.76 Destination IP 208.67.222.222 Destination IP 185.85.15.34 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 9.9.9.9 Destination IP 180.76.76.76 Destination IP 208.67.220.220 Destination IP 185.85.15.34 Destination IP 4.2.2.1 Destination IP 180.76.76.76 Destination IP 4.2.2.1 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 185.85.15.34 Destination IP 9.9.9.9 Destination IP 9.9.9.9 Destination IP 185.85.15.34 Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 4.2.2.1 Destination IP 180.76.76.76 Destination IP 208.67.222.222 Destination IP 4.2.2.1 Destination IP 4.2.2.1 Destination IP 208.67.222.222 Destination IP 180.76.76.76 Destination IP 4.2.2.1 Destination IP 180.76.76.76 Destination IP 185.85.15.34 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 185.85.15.34 Destination IP 4.2.2.1 Destination IP 9.9.9.9 Destination IP 9.9.9.9 Destination IP 180.76.76.76 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 180.76.76.76 Destination IP 180.76.76.76 Destination IP 9.9.9.9 Destination IP 208.67.222.222 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /bin/sh 779 623f61b724de0bdbbe148f6878f0c534b1b066dc77af69e8c1da11c9e06f9d4c.bin