Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

QWg2NTuodY

ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped

initial sample

Details

Filetype:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy:	5.929303283087755
Filename:	QWg2NTuodY
Filesize:	110137
MD5:	8ccfc3df4a2b63c7944837c0e3e6bb6a
SHA1:	646f16d2fb1b0a5867b69bc1dc2b369275c244b3
SHA256:	fb117b5b9ba03f145f4342b65b6268b4378660bfdc9b38a00668a2d0fcacdf2c
SHA512:	538df89b9b3f8f3a10a3b4bb224ab381b2ecd5dc661cf67171cd8aa9f9a151193a676af62c49d0f7bc8c14892a7412f8db20c61d839235f8b1dd4af942ca8769
SSDEEP:	1536:VDncDo5kWexdJ8MsLYxvNloxil8dYJqmifFWkOzw/98LmlUHklc1o4:+mI/J8M2+8dsqmaFWtM/9EB/B
Preview:	.ELF..............(.........4...8H......4. ...(........p8...8V..8V..................................P...P...............P...P...P...x...\|S..............T...T...T...................Q.td..................................-...L..................@-.,@...0....S

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Uses the "uname" system call to query kernel version information (possible evasion)	Malware Analysis System Evasion	Security Software Discovery
Enumerates processes within the "proc" file system	Persistence and Installation Behavior	OS Credential Dumping
Sample tries to kill a process (SIGKILL)	System Summary
Found detection on Joe Sandbox Cloud Basic with higher score	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion

/tmp/qemu-open.4AsbT2 (deleted)

ASCII text, with no line terminators

dropped

Details

File:	/tmp/qemu-open.4AsbT2 (deleted)
Category:	dropped
Dump:	qemu-open.4AsbT2 (deleted).12.dr
ID:	dr_2
Target ID:	12
Process:	/tmp/QWg2NTuodY
Type:	ASCII text, with no line terminators
Entropy:	3.875
Encrypted:	false
Ssdeep:	3:Tgwlp8l:Tgi0
Size:	16
Whitelisted:	false
Reputation:	low

/tmp/qemu-open.BwtYb0 (deleted)

ASCII text, with no line terminators

dropped

Details

File:	/tmp/qemu-open.BwtYb0 (deleted)
Category:	dropped
Dump:	qemu-open.BwtYb0 (deleted).12.dr
ID:	dr_0
Target ID:	12
Process:	/tmp/QWg2NTuodY
Type:	ASCII text, with no line terminators
Entropy:	3.875
Encrypted:	false
Ssdeep:	3:Tgwlp8l:Tgi0
Size:	16
Whitelisted:	false
Reputation:	low

/tmp/qemu-open.DkXuq2 (deleted)

ASCII text, with no line terminators

dropped

Details

File:	/tmp/qemu-open.DkXuq2 (deleted)
Category:	dropped
Dump:	qemu-open.DkXuq2 (deleted).12.dr
ID:	dr_3
Target ID:	12
Process:	/tmp/QWg2NTuodY
Type:	ASCII text, with no line terminators
Entropy:	3.875
Encrypted:	false
Ssdeep:	3:Tgwlp8l:Tgi0
Size:	16
Whitelisted:	false
Reputation:	low

/tmp/qemu-open.zdnyA3 (deleted)

ASCII text, with no line terminators

dropped

Details

File:	/tmp/qemu-open.zdnyA3 (deleted)
Category:	dropped
Dump:	qemu-open.zdnyA3 (deleted).12.dr
ID:	dr_1
Target ID:	12
Process:	/tmp/QWg2NTuodY
Type:	ASCII text, with no line terminators
Entropy:	3.875
Encrypted:	false
Ssdeep:	3:Tgwlp8l:Tgi0
Size:	16
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

/tmp/QWg2NTuodY

Details

PID:	5244
Target ID:	10
Parent PID:	5116
Name:	QWg2NTuodY
Path:	/tmp/QWg2NTuodY
Commandline:	/tmp/QWg2NTuodY
Size:	4956856
MD5:	5ebfcae4fe2471fcc5695c2394773ff1
Time:	09:37:04
Date:	29/10/2021

/tmp/QWg2NTuodY

n/a

Details

PID:	5246
Target ID:	11
Parent PID:	5244
Name:	QWg2NTuodY
Path:	/tmp/QWg2NTuodY
Commandline:	n/a
Size:	4956856
MD5:	5ebfcae4fe2471fcc5695c2394773ff1
Time:	09:37:04
Date:	29/10/2021

/tmp/QWg2NTuodY

n/a

Details

PID:	5248
Target ID:	12
Parent PID:	5246
Name:	QWg2NTuodY
Path:	/tmp/QWg2NTuodY
Commandline:	n/a
Size:	4956856
MD5:	5ebfcae4fe2471fcc5695c2394773ff1
Time:	09:37:04
Date:	29/10/2021

IPs

Domain

Country

Malicious

45.95.169.120

unknown

Croatia (LOCAL Name: Hrvatska)

Details

IP:	45.95.169.120
TargetID:	-1
Country:	Croatia (LOCAL Name: Hrvatska)
Countrycode:	HRV
ASN number:	42864
ASN name:	GIGANET-HUGigaNetInternetServiceProviderCoHU
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

109.202.202.202

unknown

Switzerland

Details

IP:	109.202.202.202
TargetID:	-1
Country:	Switzerland
Countrycode:	CHE
ASN number:	13030
ASN name:	INIT7CH
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.43

unknown

United Kingdom

Details

IP:	91.189.91.43
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.42

unknown

United Kingdom

Details

IP:	91.189.91.42
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

IPs