0f1589e377812d1647b40dc2568a73cb1f6d93625efd15ec8cc6da163ded6138

General

Target
fallen.mips
Size 151KB
Sample260909-3w2kwascmg
SHA256 0f1589e377812d1647b40dc2568a73cb1f6d93625efd15ec8cc6da163ded6138
MD5 5d86af64025784def9b3d6420ce1ef19
SHA1 1c18ab3bd8421919243a7d1e17fc5e971f95797b
SHA512 65b54018520ffc1e146490883259047d8bd84b98d54f1fb23cfdc18ad69a1e8524c9791a4584f17cf59771231a521ca18a1c62b9836f8fe428efa8fdf0fe1f3f
SSDEEP 3072:HFfO6zq34ObQNfJRJaO/Zbl4gIbHQr1RoquFz2+FrHT3TuaQV1J:HFfVmINxRgO/fEkrUquFLdHT3TM1J
TLSH
T154E3126649175F88CCB3D8B608E9A7342D52AA410AD38C4FC596DDC7C48DEACA2354BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  fallen.mips
- Size 151KB
- SHA256 0f1589e377812d1647b40dc2568a73cb1f6d93625efd15ec8cc6da163ded6138
- MD5 5d86af64025784def9b3d6420ce1ef19
- SHA1 1c18ab3bd8421919243a7d1e17fc5e971f95797b
- SHA512 65b54018520ffc1e146490883259047d8bd84b98d54f1fb23cfdc18ad69a1e8524c9791a4584f17cf59771231a521ca18a1c62b9836f8fe428efa8fdf0fe1f3f
- SSDEEP 3072:HFfO6zq34ObQNfJRJaO/Zbl4gIbHQr1RoquFz2+FrHT3TuaQV1J:HFfVmINxRgO/fEkrUquFLdHT3TM1J
- TLSH
  T154E3126649175F88CCB3D8B608E9A7342D52AA410AD38C4FC596DDC7C48DEACA2354BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

command_and_control credential_access discovery execution lateral_movement persistence privilege_escalation upx
- Outbound SSH connection to private host
  SSH is used for remote access. Internal traffic may indicate local host discovery or lateral movement.
  command_and_control lateral_movement
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalation
- Enumerates running processes
  Discovers information about currently running processes on the system
- Modifies rc script
  Adding/modifying system rc scripts is a common persistence mechanism.
  persistence
- Modifies systemd
  Adds/ modifies systemd service files. Likely to achieve persistence.
  persistence privilege_escalation
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
- Write file to user bin folder
  persistence
- Reads process memory
  Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
  credential_access
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1