Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

OisIh0q3Gw

ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped

initial sample

Details

Filetype:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy:	6.766934735024449
Filename:	OisIh0q3Gw
Filesize:	51584
MD5:	011afa25945a1bfa6c8397da5116ea79
SHA1:	b02c0da3cecab99eae0aac2beb18e43fd73ec8f7
SHA256:	db4e62a9609a515112f043e3ece5998c66d6eb8d5d3766719defb143cfffe31e
SHA512:	a8af466d32fe169a9a3f763473c52e855d8bfab86a6883d71761e62d5808e7e7b646a1503d24ae9413b4da8e287b81e0295821b1ee5e3110e9aa4c179635536d
SSDEEP:	768:jaixFwtLSYAagMo0ebfELdv0X3pyWfs3I9ICJUU/qMCqKomQRCvl:jaQFwtOGtv0XJfs3kICJt/qMF/RCvl
Preview:	.ELF.....................@.4...........4. ...(...............@...@.<...<...............@...@.A.@.A.p...............Q.td............................././"O.n........#.@........#.*@,....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Sample tries to kill multiple processes (SIGKILL)	System Summary
Uses the "uname" system call to query kernel version information (possible evasion)	Malware Analysis System Evasion
Enumerates processes within the "proc" file system	Persistence and Installation Behavior	OS Credential Dumping
Sample listens on a socket	Networking
Sample tries to kill a process (SIGKILL)	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

/var/cache/motd-news

ASCII text

dropped

Details

File:	/var/cache/motd-news
Category:	dropped
Dump:	motd-news.31.dr
ID:	dr_0
Target ID:	31
Process:	/usr/bin/cut
Type:	ASCII text
Entropy:	4.515771857099866
Encrypted:	false
Ssdeep:	3:P2lnI+5MsqqzNLz+FRNScHUBfRau95++sZzR5woLB1Fh0VTGTl/X5kURn:OZ8uNLzDc0pR75+9Zz/woFmIT52URn
Size:	191
Whitelisted:	false
Reputation:	moderate

Processes

Path

Cmdline

Malicious

/tmp/OisIh0q3Gw

n/a

/tmp/OisIh0q3Gw

n/a

/tmp/OisIh0q3Gw

n/a

/tmp/OisIh0q3Gw

n/a

/tmp/OisIh0q3Gw

n/a

/tmp/OisIh0q3Gw

n/a

/tmp/OisIh0q3Gw

n/a

/tmp/OisIh0q3Gw

n/a

/tmp/OisIh0q3Gw

n/a

/tmp/OisIh0q3Gw

n/a

/tmp/OisIh0q3Gw

n/a

/tmp/OisIh0q3Gw

n/a

/tmp/OisIh0q3Gw

n/a

/tmp/OisIh0q3Gw

n/a

/tmp/OisIh0q3Gw

n/a

/tmp/OisIh0q3Gw

n/a

/usr/bin/dash

n/a

/usr/bin/cat

cat /tmp/tmp.44aCm1an2s

/usr/bin/dash

n/a

/usr/bin/head

head -n 10

/usr/bin/dash

n/a

/usr/bin/tr

tr -d \\000-\\011\\013\\014\\016-\\037

/usr/bin/dash

n/a

/usr/bin/cut

cut -c -80

/usr/bin/dash

n/a

/usr/bin/cat

cat /tmp/tmp.44aCm1an2s

/usr/bin/dash

n/a

/usr/bin/head

head -n 10

/usr/bin/dash

n/a

/usr/bin/tr

tr -d \\000-\\011\\013\\014\\016-\\037

/usr/bin/dash

n/a

/usr/bin/cut

cut -c -80

/usr/bin/dash

n/a

/usr/bin/rm

rm -f /tmp/tmp.44aCm1an2s /tmp/tmp.MG72tyDHko /tmp/tmp.Y5mAFBQOFz

There are 25 hidden processes, click here to show them.

URLs

Name

Malicious

https://ubuntu.com/blog/microk8s-memory-optimisation

unknown

Details

Name:	https://ubuntu.com/blog/microk8s-memory-optimisation
TargetID:	31
From Memory:	true
Current Path:	/usr/bin/cut
Source:	motd-news.31.dr
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs