1b78a4e7422aa6baca4fab9ca9adca874a89c423a60839d95a62c39a9a934d46

General

Target
tmpsl.elf
Size 219KB
Sample260811-gv6mjsch38
SHA256 1b78a4e7422aa6baca4fab9ca9adca874a89c423a60839d95a62c39a9a934d46
MD5 27cfc97d872d55fc572a035917163e1f
SHA1 9ec1984c3a7958d499a09d7afd75b82a29dd39e7
SHA512 2df6809b56a78602e0d2533d6c4e284f05eb845ad00a884703727b02563991237293dac800bfe8920ae6398dbe6eb03bf82cc050bf1e575a6628a984982c7e8d
SSDEEP 3072:zKB7KxsKpszkl0nKwPMQTTlnCgsVnQr2:GB0sKpsgd2Lndvr
TLSH
T1FC24F606BF511EBBD41FCE3709E5028A319CE49612F93B776A38D459BE2760E09E3874
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  tmpsl.elf
- Size 219KB
- SHA256 1b78a4e7422aa6baca4fab9ca9adca874a89c423a60839d95a62c39a9a934d46
- MD5 27cfc97d872d55fc572a035917163e1f
- SHA1 9ec1984c3a7958d499a09d7afd75b82a29dd39e7
- SHA512 2df6809b56a78602e0d2533d6c4e284f05eb845ad00a884703727b02563991237293dac800bfe8920ae6398dbe6eb03bf82cc050bf1e575a6628a984982c7e8d
- SSDEEP 3072:zKB7KxsKpszkl0nKwPMQTTlnCgsVnQr2:GB0sKpsgd2Lndvr
- TLSH
  T1FC24F606BF511EBBD41FCE3709E5028A319CE49612F93B776A38D459BE2760E09E3874
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

command_and_control defense_evasion discovery
- Contacts a large (55295) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
- Renames itself
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads MAC address of network interface
  Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
  defense_evasion discovery
- Reads network interface configuration
  Fetches information about one or more active network interfaces.
  discovery
behavioral1