Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

1TnmkstVG8

ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped

initial sample

Details

Filetype:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy:	6.100479824147886
Filename:	1TnmkstVG8
Filesize:	38344
MD5:	2f7ce4fdab3edd7aed014bd5a124c718
SHA1:	0b1e76fac74052db6e7a342cdba0f90622100093
SHA256:	6597350ca45adfe532bd93ffde9c92d98f2ed1ecedd4d7d73c6dd147b0b613a9
SHA512:	3ccfd7025235684ef7663b204620b372536a484a10695705a1e0cb6aaa9af6baddc9f4fb7889a6f34394f2223a15031e5312917b9491535a4e63d0bca6aac98c
SSDEEP:	384:scwxATYTY/41v0pvRFU+preqdBrF6wleRlJT0nJ2JMjP5:scwxAEM9RO+l8t4Nh
Preview:	.ELF...........................4...8.....4. ...(..........................................................!.........dt.Q................................@..(....@..y................#.....c...`.....!..... ,..@.....".........`......$ ,.. ,..@...........`....

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Uses the "uname" system call to query kernel version information (possible evasion)	Malware Analysis System Evasion	Security Software Discovery
Found detection on Joe Sandbox Cloud Basic with higher score	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion

/var/cache/motd-news

ASCII text

dropped

Details

File:	/var/cache/motd-news
Category:	dropped
Dump:	motd-news.26.dr
ID:	dr_0
Target ID:	26
Process:	/usr/bin/cut
Type:	ASCII text
Entropy:	4.515771857099866
Encrypted:	false
Ssdeep:	3:P2lnI+5MsqqzNLz+FRNScHUBfRau95++sZzR5woLB1Fh0VTGTl/X5kURn:OZ8uNLzDc0pR75+9Zz/woFmIT52URn
Size:	191
Whitelisted:	false
Reputation:	moderate

Processes

Path

Cmdline

Malicious

/tmp/1TnmkstVG8

n/a

/usr/bin/dash

n/a

/usr/bin/cat

cat /tmp/tmp.gtT3aisjF5

/usr/bin/dash

n/a

/usr/bin/head

head -n 10

/usr/bin/dash

n/a

/usr/bin/tr

tr -d \\000-\\011\\013\\014\\016-\\037

/usr/bin/dash

n/a

/usr/bin/cut

cut -c -80

/usr/bin/dash

n/a

/usr/bin/cat

cat /tmp/tmp.gtT3aisjF5

/usr/bin/dash

n/a

/usr/bin/head

head -n 10

/usr/bin/dash

n/a

/usr/bin/tr

tr -d \\000-\\011\\013\\014\\016-\\037

/usr/bin/dash

n/a

/usr/bin/cut

cut -c -80

/usr/bin/dash

n/a

/usr/bin/rm

rm -f /tmp/tmp.gtT3aisjF5 /tmp/tmp.0HpvoUv25y /tmp/tmp.kZRxhtfsZX

There are 10 hidden processes, click here to show them.

URLs

Name

Malicious

https://ubuntu.com/blog/microk8s-memory-optimisation

unknown

Details

Name:	https://ubuntu.com/blog/microk8s-memory-optimisation
TargetID:	26
From Memory:	true
Current Path:	/usr/bin/cut
Source:	motd-news.26.dr
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

34.249.145.219

unknown

United States

Details

IP:	34.249.145.219
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	16509
ASN name:	AMAZON-02US
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

45.95.169.120

unknown

Croatia (LOCAL Name: Hrvatska)

Details

IP:	45.95.169.120
TargetID:	-1
Country:	Croatia (LOCAL Name: Hrvatska)
Countrycode:	HRV
ASN number:	42864
ASN name:	GIGANET-HUGigaNetInternetServiceProviderCoHU
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

46.244.112.164

unknown

Netherlands

Details

IP:	46.244.112.164
TargetID:	-1
Country:	Netherlands
Countrycode:	NLD
ASN number:	51088
ASN name:	A2BNL
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

109.202.202.202

unknown

Switzerland

Details

IP:	109.202.202.202
TargetID:	-1
Country:	Switzerland
Countrycode:	CHE
ASN number:	13030
ASN name:	INIT7CH
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

189.57.206.167

unknown

Brazil

Details

IP:	189.57.206.167
TargetID:	-1
Country:	Brazil
Countrycode:	BRA
ASN number:	10429
ASN name:	TELEFONICABRASILSABR
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

37.80.245.107

unknown

Germany

Details

IP:	37.80.245.107
TargetID:	-1
Country:	Germany
Countrycode:	DEU
ASN number:	3320
ASN name:	DTAGInternetserviceprovideroperationsDE
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.43

unknown

United Kingdom

Details

IP:	91.189.91.43
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.42

unknown

United Kingdom

Details

IP:	91.189.91.42
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs

IPs