Automated Malware Analysis IOC Report for

Processes

Path

Cmdline

Malicious

/tmp/beamer.x86-20211202-2350

Details

PID:	5212
Target ID:	10
Parent PID:	5115
Name:	beamer.x86-20211202-2350
Path:	/tmp/beamer.x86-20211202-2350
Commandline:	/tmp/beamer.x86-20211202-2350
Size:	42164
MD5:	04e178a6fe92b38222e03a4c2e2303e0
Time:	01:02:02
Date:	03/12/2021

/tmp/beamer.x86-20211202-2350

n/a

Details

PID:	5213
Target ID:	11
Parent PID:	5212
Name:	beamer.x86-20211202-2350
Path:	/tmp/beamer.x86-20211202-2350
Commandline:	n/a
Size:	42164
MD5:	04e178a6fe92b38222e03a4c2e2303e0
Time:	01:02:02
Date:	03/12/2021

/tmp/beamer.x86-20211202-2350

n/a

Details

PID:	5214
Target ID:	12
Parent PID:	5212
Name:	beamer.x86-20211202-2350
Path:	/tmp/beamer.x86-20211202-2350
Commandline:	n/a
Size:	42164
MD5:	04e178a6fe92b38222e03a4c2e2303e0
Time:	01:02:02
Date:	03/12/2021

/tmp/beamer.x86-20211202-2350

n/a

Details

PID:	5215
Target ID:	13
Parent PID:	5212
Name:	beamer.x86-20211202-2350
Path:	/tmp/beamer.x86-20211202-2350
Commandline:	n/a
Size:	42164
MD5:	04e178a6fe92b38222e03a4c2e2303e0
Time:	01:02:02
Date:	03/12/2021

/usr/bin/dash

n/a

Details

PID:	5253
Target ID:	14
Parent PID:	4331
Name:	dash
Path:	/usr/bin/dash
Commandline:	n/a
Size:	129816
MD5:	1e6b1c887c59a315edb7eb9a315fc84c
Time:	01:03:25
Date:	03/12/2021

/usr/bin/rm

rm -f /tmp/tmp.AlKkHgaC4m /tmp/tmp.GpcnZvv7fC /tmp/tmp.zmqkJtmHaS

Details

PID:	5253
Target ID:	15
Parent PID:	4331
Name:	rm
Path:	/usr/bin/rm
Commandline:	rm -f /tmp/tmp.AlKkHgaC4m /tmp/tmp.GpcnZvv7fC /tmp/tmp.zmqkJtmHaS
Size:	72056
MD5:	aa2b5496fdbfd88e38791ab81f90b95b
Time:	01:03:25
Date:	03/12/2021

IPs

Domain

Country

Malicious

45.134.225.20

unknown

Germany

Details

IP:	45.134.225.20
TargetID:	-1
Country:	Germany
Countrycode:	DEU
ASN number:	203380
ASN name:	DAINTERNATIONALGROUPGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable	System Summary
Connects to IPs without corresponding DNS lookups	Networking

34.249.145.219

unknown

United States

Details

IP:	34.249.145.219
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	16509
ASN name:	AMAZON-02US
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

109.202.202.202

unknown

Switzerland

Details

IP:	109.202.202.202
TargetID:	-1
Country:	Switzerland
Countrycode:	CHE
ASN number:	13030
ASN name:	INIT7CH
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.43

unknown

United Kingdom

Details

IP:	91.189.91.43
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.42

unknown

United Kingdom

Details

IP:	91.189.91.42
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Processes

IPs