Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

apL.mips-20220121-0317

ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped

initial sample

Details

Filetype:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy:	7.946793281986122
Filename:	apL.mips-20220121-0317
Filesize:	46204
MD5:	13e8ba90e042ab6bbc3821fad3cf1837
SHA1:	c7dbaf4b95ad104e35570b287b74f8375f1e5d01
SHA256:	37b5a5d9d5ab50a8dff649678a9f10f26a5923186c97d1a623902b68e795abdc
SHA512:	ceb092fbdfd3ad39f6a49ee9dbf9d212ea7d3c9eec014dcc2bc5ba83bc6b1ab8f02965c453b1c076979c128011dfda8f12f32d6f4e363d7af8c4f951243a9cc7
SSDEEP:	768:r5FMs2rPZhkq92ZVHGWVLQttQwuHcIB085oYk6N50IwumgJgGlzDpbuR1JAnAtlZ:p2rd9CmKLstQwuYvYj7hw8VJuLaihT
Preview:	.ELF.......................x...4.........4. ...(.........................................._\|.F_\|.F_\|....................UPX!.d.....................b.......?.E.h4...@b..) ..]..0..ap%d>.>y....\._......@.....g#`.....o2Z.....x.....-"...i..;%...GT..e1.3"......

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Opens /proc/net/* files useful for finding connected devices and routers	Spreading	Remote System Discovery
Yara signature match	System Summary
Uses the "uname" system call to query kernel version information (possible evasion)	Malware Analysis System Evasion
Executes commands using a shell command-line interpreter	Persistence and Installation Behavior	Scripting
URLs found in memory or binary data	Networking
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

/run/systemd/resolve/stub-resolv.conf

ASCII text

dropped

Details

File:	/run/systemd/resolve/stub-resolv.conf
Category:	dropped
Dump:	stub-resolv.conf.13.dr
ID:	dr_1
Target ID:	13
Process:	/tmp/apL.mips-20220121-0317
Type:	ASCII text
Entropy:	3.3918926446809334
Encrypted:	false
Ssdeep:	3:KkZRAkd:KaAu
Size:	38
Whitelisted:	false
Reputation:	moderate

/tmp/qemu-open.JEqahA (deleted)

ASCII text

dropped

Details

File:	/tmp/qemu-open.JEqahA (deleted)
Category:	dropped
Dump:	qemu-open.JEqahA (deleted).10.dr
ID:	dr_0
Target ID:	10
Process:	/tmp/apL.mips-20220121-0317
Type:	ASCII text
Entropy:	3.709552666863289
Encrypted:	false
Ssdeep:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
Size:	230
Whitelisted:	false
Reputation:	moderate

Processes

Path

Cmdline

Malicious

/tmp/apL.mips-20220121-0317

n/a

/tmp/apL.mips-20220121-0317

n/a

/tmp/apL.mips-20220121-0317

n/a

/tmp/apL.mips-20220121-0317

n/a

/bin/sh

sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"

/bin/sh

n/a

/usr/bin/rm

rm -rf /tmp/apL.mips-20220121-0317 /tmp/config-err-dHT8bZ /tmp/dmesgtail.log /tmp/snap.lxd /tmp/ssh-hOQ5FjG2iVgO /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-ModemManager.service-c4RYFi /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-colord.service-gKIF8e /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-gB0a9f /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-switcheroo-control.service-APWnLg /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-resolved.service-AfPZzg /tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-upower.service-x0xO0i /tmp/tmp.qtPPbjdkIb /tmp/tmp.tvSNtKHMtv /tmp/tmp.xTL7lOZ5v5 /tmp/vmware-root_721-4290559889 /var/backups /var/cache /var/crash /var/lib /var/local /var/lock /var/log /var/mail /var/metrics /var/opt /var/run /var/snap /var/spool /var/tmp /var/run/NetworkManager /var/run/acpid.pid /var/run/acpid.socket /var/run/apport.lock /var/run/avahi-daemon /var/run/blkid /var/run/cloud-init /var/run/console-setup /var/run/crond.pid /var/run/crond.reboot /var/run/cryptsetup /var/run/cups /var/run/dbus /var/run/dmeventd-client /var/run/dmeventd-server /var/run/gdm3 /var/run/gdm3.pid /var/run/initctl /var/run/initramfs /var/run/irqbalance /var/run/lock /var/run/log /var/run/lvm /var/run/mlocate.daily.lock /var/run/mono-xsp4 /var/run/mono-xsp4.pid /var/run/motd.d /var/run/mount /var/run/multipathd.pid /var/run/netns /var/run/network /var/run/screen /var/run/sendsigs.omit.d /var/run/shm /var/run/snapd /var/run/snapd-snap.socket /var/run/snapd.socket /var/run/speech-dispatcher /var/run/spice-vdagentd /var/run/sshd /var/run/sshd.pid /var/run/sudo /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/udisks2 /var/run/unattended-upgrades.lock /var/run/user /var/run/utmp /var/run/uuidd /var/run/vmware /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-ModemManager.service-J6Q1Te /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-colord.service-srP90f /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-biJ0Gi /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-switcheroo-control.service-1jIxdj /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-llmWag /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-resolved.service-X16eHh /var/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-upower.service-GpSnaf

/tmp/apL.mips-20220121-0317

n/a

/bin/sh

sh -c "rm -rf /var/log/wtmp"

/bin/sh

n/a

/usr/bin/rm

rm -rf /var/log/wtmp

/tmp/apL.mips-20220121-0317

n/a

/bin/sh

sh -c "rm -rf /tmp/*"

/bin/sh

n/a

/usr/bin/rm

rm -rf /tmp/*

/tmp/apL.mips-20220121-0317

n/a

/bin/sh

sh -c "rm -rf /bin/netstat"

/bin/sh

n/a

/usr/bin/rm

rm -rf /bin/netstat

/tmp/apL.mips-20220121-0317

n/a

/bin/sh

sh -c "iptables -F"

/bin/sh

n/a

/usr/sbin/iptables

iptables -F

/tmp/apL.mips-20220121-0317

n/a

/bin/sh

sh -c "pkill -9 busybox"

/bin/sh

n/a

/usr/bin/pkill

pkill -9 busybox

/tmp/apL.mips-20220121-0317

n/a

/bin/sh

sh -c "pkill -9 perl"

/bin/sh

n/a

/usr/bin/pkill

pkill -9 perl

/tmp/apL.mips-20220121-0317

n/a

/bin/sh

sh -c "pkill -9 python"

/bin/sh

n/a

/usr/bin/pkill

pkill -9 python

/tmp/apL.mips-20220121-0317

n/a

/bin/sh

sh -c "service iptables stop"

/bin/sh

n/a

/usr/sbin/service

service iptables stop

/usr/sbin/service

n/a

/usr/bin/basename

basename /usr/sbin/service

/usr/sbin/service

n/a

/usr/bin/basename

basename /usr/sbin/service

/usr/sbin/service

n/a

/usr/bin/systemctl

systemctl --quiet is-active multi-user.target

/usr/sbin/service

n/a

/usr/sbin/service

n/a

/usr/bin/systemctl

systemctl list-unit-files --full --type=socket

/usr/sbin/service

n/a

/usr/bin/sed

sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p

/usr/bin/systemctl

systemctl stop iptables.service

/tmp/apL.mips-20220121-0317

n/a

/bin/sh

sh -c "/sbin/iptables -F; /sbin/iptables -X"

/bin/sh

n/a

/sbin/iptables

/sbin/iptables -F

/bin/sh

n/a

/sbin/iptables

/sbin/iptables -X

/tmp/apL.mips-20220121-0317

n/a

/bin/sh

sh -c "service firewalld stop"

/bin/sh

n/a

/usr/sbin/service

service firewalld stop

/usr/sbin/service

n/a

/usr/bin/basename

basename /usr/sbin/service

/usr/sbin/service

n/a

/usr/bin/basename

basename /usr/sbin/service

/usr/sbin/service

n/a

/usr/bin/systemctl

systemctl --quiet is-active multi-user.target

/usr/sbin/service

n/a

/usr/sbin/service

n/a

/usr/bin/systemctl

systemctl list-unit-files --full --type=socket

/usr/sbin/service

n/a

/usr/bin/sed

sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p

/usr/bin/systemctl

systemctl stop firewalld.service

/tmp/apL.mips-20220121-0317

n/a

/bin/sh

sh -c "rm -rf ~/.bash_history"

/bin/sh

n/a

/usr/bin/rm

rm -rf /root/.bash_history

/tmp/apL.mips-20220121-0317

n/a

/bin/sh

sh -c "history -c"

/usr/bin/dash

n/a

/usr/bin/cat

cat /tmp/tmp.qtPPbjdkIb

/usr/bin/dash

n/a

/usr/bin/head

head -n 10

/usr/bin/dash

n/a

/usr/bin/tr

tr -d \\000-\\011\\013\\014\\016-\\037

/usr/bin/dash

n/a

/usr/bin/cut

cut -c -80

/usr/bin/dash

n/a

/usr/bin/cat

cat /tmp/tmp.qtPPbjdkIb

/usr/bin/dash

n/a

/usr/bin/head

head -n 10

/usr/bin/dash

n/a

/usr/bin/tr

tr -d \\000-\\011\\013\\014\\016-\\037

/usr/bin/dash

n/a

/usr/bin/cut

cut -c -80

/usr/bin/dash

n/a

/usr/bin/rm

rm -f /tmp/tmp.qtPPbjdkIb /tmp/tmp.tvSNtKHMtv /tmp/tmp.xTL7lOZ5v5

There are 88 hidden processes, click here to show them.

URLs

Name

Malicious

http://upx.sf.net

unknown

Details

Name:	http://upx.sf.net
TargetID:	10
From Memory:	true
Current Path:	/tmp/apL.mips-20220121-0317
Source:	apL.mips-20220121-0317
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Sample is packed with UPX	Data Obfuscation	Obfuscated Files or Information
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

54.171.230.55

unknown

United States

Details

IP:	54.171.230.55
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	16509
ASN name:	AMAZON-02US
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

123.178.234.190

unknown

China

Details

IP:	123.178.234.190
TargetID:	-1
Country:	China
Countrycode:	CHN
ASN number:	4809
ASN name:	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

36.65.75.239

unknown

Indonesia

Details

IP:	36.65.75.239
TargetID:	-1
Country:	Indonesia
Countrycode:	IDN
ASN number:	7713
ASN name:	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

192.236.160.175

unknown

United States

Details

IP:	192.236.160.175
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	54290
ASN name:	HOSTWINDSUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

109.202.202.202

unknown

Switzerland

Details

IP:	109.202.202.202
TargetID:	-1
Country:	Switzerland
Countrycode:	CHE
ASN number:	13030
ASN name:	INIT7CH
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

123.17.44.158

unknown

Viet Nam

Details

IP:	123.17.44.158
TargetID:	-1
Country:	Viet Nam
Countrycode:	VNM
ASN number:	45899
ASN name:	VNPT-AS-VNVNPTCorpVN
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.43

unknown

United Kingdom

Details

IP:	91.189.91.43
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

60.220.215.198

unknown

China

Details

IP:	60.220.215.198
TargetID:	-1
Country:	China
Countrycode:	CHN
ASN number:	4837
ASN name:	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.42

unknown

United Kingdom

Details

IP:	91.189.91.42
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs

IPs