Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

csB31kWt10

ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped

initial sample

Details

Filetype:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy:	5.526002031107092
Filename:	csB31kWt10
Filesize:	48624
MD5:	df1ed6e73703ce09673aa4525975d129
SHA1:	4b3444321f460d0ea48f4e96eb0ea45b27b885a6
SHA256:	1d41b0a9c3b189c68bf219335a60f8156857fc6cef890e165e9ad2c48b15103a
SHA512:	6776e5c9d462128f3ae4f07c019f4d5b195890116f7158359adb4e7a24642985db262eb3e4ab832fd721030635b96343f6bf3848b3775bcf772fd6e44d2f67e0
SSDEEP:	768:n24VmMBIOoR7sYhz9ezjFFZ4GZJZTXiT+dQeEogrig0cH:PYhz98jnZ4yzy3rl5
Preview:	.ELF....................`.@.4...........4. ...(...............@...@...........................D...D.....`)..........Q.td...............................<\|7.'!......'.......................<X7.'!... .........9'.. ........................<(7.'!.............9

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Uses the "uname" system call to query kernel version information (possible evasion)	Malware Analysis System Evasion	Security Software Discovery
Enumerates processes within the "proc" file system	Persistence and Installation Behavior	OS Credential Dumping
Sample tries to kill a process (SIGKILL)	System Summary
Found detection on Joe Sandbox Cloud Basic with higher score	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion

/tmp/qemu-open.TuD6GS (deleted)

ASCII text, with no line terminators

dropped

Details

File:	/tmp/qemu-open.TuD6GS (deleted)
Category:	dropped
Dump:	qemu-open.TuD6GS (deleted).12.dr
ID:	dr_1
Target ID:	12
Process:	/tmp/csB31kWt10
Type:	ASCII text, with no line terminators
Entropy:	3.625
Encrypted:	false
Ssdeep:	3:TgBCyy:TgYf
Size:	16
Whitelisted:	false
Reputation:	low

/tmp/qemu-open.bKPayR (deleted)

ASCII text, with no line terminators

dropped

Details

File:	/tmp/qemu-open.bKPayR (deleted)
Category:	dropped
Dump:	qemu-open.bKPayR (deleted).12.dr
ID:	dr_3
Target ID:	12
Process:	/tmp/csB31kWt10
Type:	ASCII text, with no line terminators
Entropy:	3.625
Encrypted:	false
Ssdeep:	3:TgBCyy:TgYf
Size:	16
Whitelisted:	false
Reputation:	low

/tmp/qemu-open.iXUKLT (deleted)

ASCII text, with no line terminators

dropped

Details

File:	/tmp/qemu-open.iXUKLT (deleted)
Category:	dropped
Dump:	qemu-open.iXUKLT (deleted).12.dr
ID:	dr_0
Target ID:	12
Process:	/tmp/csB31kWt10
Type:	ASCII text, with no line terminators
Entropy:	3.625
Encrypted:	false
Ssdeep:	3:TgBCyy:TgYf
Size:	16
Whitelisted:	false
Reputation:	low

/tmp/qemu-open.mDwNfR (deleted)

ASCII text, with no line terminators

dropped

Details

File:	/tmp/qemu-open.mDwNfR (deleted)
Category:	dropped
Dump:	qemu-open.mDwNfR (deleted).12.dr
ID:	dr_2
Target ID:	12
Process:	/tmp/csB31kWt10
Type:	ASCII text, with no line terminators
Entropy:	3.625
Encrypted:	false
Ssdeep:	3:TgBCyy:TgYf
Size:	16
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

/tmp/csB31kWt10

Details

PID:	5241
Target ID:	10
Parent PID:	5119
Name:	csB31kWt10
Path:	/tmp/csB31kWt10
Commandline:	/tmp/csB31kWt10
Size:	5773336
MD5:	0d6f61f82cf2f781c6eb0661071d42d9
Time:	09:39:54
Date:	29/10/2021

/tmp/csB31kWt10

n/a

Details

PID:	5244
Target ID:	11
Parent PID:	5241
Name:	csB31kWt10
Path:	/tmp/csB31kWt10
Commandline:	n/a
Size:	5773336
MD5:	0d6f61f82cf2f781c6eb0661071d42d9
Time:	09:39:55
Date:	29/10/2021

/tmp/csB31kWt10

n/a

Details

PID:	5246
Target ID:	12
Parent PID:	5244
Name:	csB31kWt10
Path:	/tmp/csB31kWt10
Commandline:	n/a
Size:	5773336
MD5:	0d6f61f82cf2f781c6eb0661071d42d9
Time:	09:39:55
Date:	29/10/2021

IPs

Domain

Country

Malicious

121.66.166.226

unknown

Korea Republic of

Details

IP:	121.66.166.226
TargetID:	-1
Country:	Korea Republic of
Countrycode:	KOR
ASN number:	3786
ASN name:	LGDACOMLGDACOMCorporationKR
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

45.95.169.120

unknown

Croatia (LOCAL Name: Hrvatska)

Details

IP:	45.95.169.120
TargetID:	-1
Country:	Croatia (LOCAL Name: Hrvatska)
Countrycode:	HRV
ASN number:	42864
ASN name:	GIGANET-HUGigaNetInternetServiceProviderCoHU
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

109.202.202.202

unknown

Switzerland

Details

IP:	109.202.202.202
TargetID:	-1
Country:	Switzerland
Countrycode:	CHE
ASN number:	13030
ASN name:	INIT7CH
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.43

unknown

United Kingdom

Details

IP:	91.189.91.43
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.42

unknown

United Kingdom

Details

IP:	91.189.91.42
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

IPs