Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

78mne21kC0

ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped

initial sample

Details

Filetype:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy:	6.069222226696124
Filename:	78mne21kC0
Filesize:	89492
MD5:	12cf087e49d1f9abc65f3b9f6d62470c
SHA1:	464abb479aa8d908d534ba39691b427e21b65566
SHA256:	9b4db7f46e24f6f9748d2b82a2497fe237fce6b1f4922c6a4eaffd286a2d3466
SHA512:	156e7dcb2e6bf92cb46e7e1d0dffba83044a930a7a60edc074967528016a0a955ec70d5e016c33c6d72ff5b2d9ae38563fedfe42ed9db06d37d9cf2150ade3b2
SSDEEP:	1536:AcpLOIVa0aIh8FuX2W4Wsyf0/zH1B3fc+iDwy8RAlC:AcpyqaId+WFMXxiDwy8RAlC
Preview:	.ELF.......................D...4..[......4. ...(......................K...K....... .......K...k...k.......g....... .dt.Q............................NV..a....da...".N^NuNV..J9..odf>"y..k. QJ.g.X.#...k.N."y..k. QJ.f.A.....J.g.Hy..K.N.X.......odN^NuNV..N^NuN

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Opens /proc/net/* files useful for finding connected devices and routers	Spreading	Remote System Discovery
Uses the "uname" system call to query kernel version information (possible evasion)	Malware Analysis System Evasion	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion

/tmp/qemu-open.cFPgFo (deleted)

ASCII text

dropped

Details

File:	/tmp/qemu-open.cFPgFo (deleted)
Category:	dropped
Dump:	qemu-open.cFPgFo (deleted).10.dr
ID:	dr_0
Target ID:	10
Process:	/tmp/78mne21kC0
Type:	ASCII text
Entropy:	3.709552666863289
Encrypted:	false
Ssdeep:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
Size:	230
Whitelisted:	false
Reputation:	moderate

Processes

Path

Cmdline

Malicious

/tmp/78mne21kC0

Details

PID:	5226
Target ID:	10
Parent PID:	5114
Name:	78mne21kC0
Path:	/tmp/78mne21kC0
Commandline:	/tmp/78mne21kC0
Size:	4463432
MD5:	cd177594338c77b895ae27c33f8f86cc
Time:	22:41:00
Date:	27/09/2021

/tmp/78mne21kC0

n/a

Details

PID:	5228
Target ID:	11
Parent PID:	5226
Name:	78mne21kC0
Path:	/tmp/78mne21kC0
Commandline:	n/a
Size:	4463432
MD5:	cd177594338c77b895ae27c33f8f86cc
Time:	22:41:00
Date:	27/09/2021

/tmp/78mne21kC0

n/a

Details

PID:	5230
Target ID:	12
Parent PID:	5226
Name:	78mne21kC0
Path:	/tmp/78mne21kC0
Commandline:	n/a
Size:	4463432
MD5:	cd177594338c77b895ae27c33f8f86cc
Time:	22:41:00
Date:	27/09/2021

/tmp/78mne21kC0

n/a

Details

PID:	5232
Target ID:	13
Parent PID:	5230
Name:	78mne21kC0
Path:	/tmp/78mne21kC0
Commandline:	n/a
Size:	4463432
MD5:	cd177594338c77b895ae27c33f8f86cc
Time:	22:41:00
Date:	27/09/2021

IPs

Domain

Country

Malicious

167.114.109.203

unknown

Canada

Details

IP:	167.114.109.203
TargetID:	-1
Country:	Canada
Countrycode:	CAN
ASN number:	16276
ASN name:	OVHFR
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

109.202.202.202

unknown

Switzerland

Details

IP:	109.202.202.202
TargetID:	-1
Country:	Switzerland
Countrycode:	CHE
ASN number:	13030
ASN name:	INIT7CH
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.43

unknown

United Kingdom

Details

IP:	91.189.91.43
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.42

unknown

United Kingdom

Details

IP:	91.189.91.42
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

IPs