Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

qlmOM0y98B

ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped

initial sample

Details

Filetype:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy:	6.199094302349671
Filename:	qlmOM0y98B
Filesize:	35320
MD5:	6c982efa63458b428ed98b6f2fa70165
SHA1:	199fd3f587ed36e207696f3642986bd508dc0839
SHA256:	1b20443752270cfe8fcd3f4d21ca7fbb9094e150d1b508826eaf1a454280d40b
SHA512:	73c07c0aeec003579fa0784f907e85a0db89cb4197b7565a99ad08fa463b9e8ffc789f6426f1ed73e4284bffc6587cbfd82262f3762274f102acde9e62cc00c8
SSDEEP:	384:I391PeYMJpZr3ZMrnk8VcAUpNTMOfQYQkmxgAqFP1lhlKTnaNOOHtNNDmV3azu:e9hmXrck86AUYnY3c2NzNNNDa
Preview:	.ELF...........................4.........4. ...(......................s...s...............s...s...s.......%`........dt.Q.............................!..\|......$H...H.l=...$8!. \|...N.. .!..\|.......?..........8..../...@..\?.....s..+../...A..$8...})....s.N..

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Uses the "uname" system call to query kernel version information (possible evasion)	Malware Analysis System Evasion
Enumerates processes within the "proc" file system	Persistence and Installation Behavior	OS Credential Dumping
Sample tries to kill a process (SIGKILL)	System Summary
Found detection on Joe Sandbox Cloud Basic with higher score	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

/tmp/qemu-open.6hO9oM (deleted)

ASCII text, with no line terminators

dropped

Details

File:	/tmp/qemu-open.6hO9oM (deleted)
Category:	dropped
Dump:	qemu-open.6hO9oM (deleted).12.dr
ID:	dr_1
Target ID:	12
Process:	/tmp/qlmOM0y98B
Type:	ASCII text, with no line terminators
Entropy:	3.75
Encrypted:	false
Ssdeep:	3:Tgowl:TgoQ
Size:	16
Whitelisted:	false
Reputation:	low

/tmp/qemu-open.YxTKIM (deleted)

ASCII text, with no line terminators

dropped

Details

File:	/tmp/qemu-open.YxTKIM (deleted)
Category:	dropped
Dump:	qemu-open.YxTKIM (deleted).12.dr
ID:	dr_3
Target ID:	12
Process:	/tmp/qlmOM0y98B
Type:	ASCII text, with no line terminators
Entropy:	3.75
Encrypted:	false
Ssdeep:	3:Tgowl:TgoQ
Size:	16
Whitelisted:	false
Reputation:	low

/tmp/qemu-open.a4xBGL (deleted)

ASCII text, with no line terminators

dropped

Details

File:	/tmp/qemu-open.a4xBGL (deleted)
Category:	dropped
Dump:	qemu-open.a4xBGL (deleted).12.dr
ID:	dr_2
Target ID:	12
Process:	/tmp/qlmOM0y98B
Type:	ASCII text, with no line terminators
Entropy:	3.75
Encrypted:	false
Ssdeep:	3:Tgowl:TgoQ
Size:	16
Whitelisted:	false
Reputation:	low

/tmp/qemu-open.cTqsEP (deleted)

ASCII text, with no line terminators

dropped

Details

File:	/tmp/qemu-open.cTqsEP (deleted)
Category:	dropped
Dump:	qemu-open.cTqsEP (deleted).12.dr
ID:	dr_0
Target ID:	12
Process:	/tmp/qlmOM0y98B
Type:	ASCII text, with no line terminators
Entropy:	3.75
Encrypted:	false
Ssdeep:	3:Tgowl:TgoQ
Size:	16
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

/tmp/qlmOM0y98B

Details

PID:	5241
Target ID:	10
Parent PID:	5117
Name:	qlmOM0y98B
Path:	/tmp/qlmOM0y98B
Commandline:	/tmp/qlmOM0y98B
Size:	5388968
MD5:	ae65271c943d3451b7f026d1fadccea6
Time:	09:53:18
Date:	29/10/2021

/tmp/qlmOM0y98B

n/a

Details

PID:	5243
Target ID:	11
Parent PID:	5241
Name:	qlmOM0y98B
Path:	/tmp/qlmOM0y98B
Commandline:	n/a
Size:	5388968
MD5:	ae65271c943d3451b7f026d1fadccea6
Time:	09:53:18
Date:	29/10/2021

/tmp/qlmOM0y98B

n/a

Details

PID:	5245
Target ID:	12
Parent PID:	5243
Name:	qlmOM0y98B
Path:	/tmp/qlmOM0y98B
Commandline:	n/a
Size:	5388968
MD5:	ae65271c943d3451b7f026d1fadccea6
Time:	09:53:18
Date:	29/10/2021

IPs

Domain

Country

Malicious

45.95.169.120

unknown

Croatia (LOCAL Name: Hrvatska)

Details

IP:	45.95.169.120
TargetID:	-1
Country:	Croatia (LOCAL Name: Hrvatska)
Countrycode:	HRV
ASN number:	42864
ASN name:	GIGANET-HUGigaNetInternetServiceProviderCoHU
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

109.202.202.202

unknown

Switzerland

Details

IP:	109.202.202.202
TargetID:	-1
Country:	Switzerland
Countrycode:	CHE
ASN number:	13030
ASN name:	INIT7CH
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.43

unknown

United Kingdom

Details

IP:	91.189.91.43
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.42

unknown

United Kingdom

Details

IP:	91.189.91.42
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)	Networking
Connects to IPs without corresponding DNS lookups	Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

IPs