Analysis
-
max time kernel
5007s -
max time network
124s -
platform
linux_amd64 -
resource
ubuntu-amd64 -
submitted
16-01-2021 14:50
Static task
static1
Behavioral task
behavioral1
Sample
vulcan.x64
Resource
ubuntu-amd64
0 signatures
0 seconds
General
-
Target
vulcan.x64
-
Size
206KB
-
MD5
db7eec3f7a375bf9a4d2eb4c130a1556
-
SHA1
dba87b82e70847ab6a78393628592650b2569f64
-
SHA256
3668b167f5c9083a9738cfc4bd863a07379a5b02ee14f48a10fb1240f3e421a6
-
SHA512
886ad861a214a2165301f1cb8cd2775c771f2aed9a6ef8be65be8efd450bd47175db2e5f884474d5adfacd5e6f1d3b3ecbdf9afe19050557a459657ccaeec70c
Score
8/10
Malware Config
Signatures
-
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
Processes:
description ioc /etc/hosts /etc/hosts -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
-
Reads CPU attributes 1 TTPs 2 IoCs
Processes:
uptimewdescription ioc Process /sys/devices/system/cpu/online /sys/devices/system/cpu/online uptime /sys/devices/system/cpu/online /sys/devices/system/cpu/online w -
Reads runtime system information 188 IoCs
Reads data from /proc virtual filesystem.
Processes:
wdescription ioc Process /proc/250/cmdline /proc/250/cmdline w /proc/443/cmdline /proc/443/cmdline w /proc/167/stat /proc/167/stat w /proc/237/cmdline /proc/237/cmdline w /proc/477/cmdline /proc/477/cmdline w /proc/700/stat /proc/700/stat w /proc/uptime /proc/uptime w /proc/9/cmdline /proc/9/cmdline w /proc/33/cmdline /proc/33/cmdline w /proc/151/cmdline /proc/151/cmdline w /proc/153/stat /proc/153/stat w /proc/160/cmdline /proc/160/cmdline w /proc/250/stat /proc/250/stat w /proc/561/cmdline /proc/561/cmdline w /proc/3/cmdline /proc/3/cmdline w /proc/5/cmdline /proc/5/cmdline w /proc/81/stat /proc/81/stat w /proc/479/cmdline /proc/479/cmdline w /proc/8/stat /proc/8/stat w /proc/19/cmdline /proc/19/cmdline w /proc/97/stat /proc/97/stat w /proc/169/cmdline /proc/169/cmdline w /proc/4/cmdline /proc/4/cmdline w /proc/13/cmdline /proc/13/cmdline w /proc/162/cmdline /proc/162/cmdline w /proc/163/cmdline /proc/163/cmdline w /proc/166/stat /proc/166/stat w /proc/300/cmdline /proc/300/cmdline w /proc/699/stat /proc/699/stat w /proc/22/stat /proc/22/stat w /proc/158/cmdline /proc/158/cmdline w /proc/77/stat /proc/77/stat w /proc/164/stat /proc/164/stat w /proc/302/stat /proc/302/stat w /proc/416/cmdline /proc/416/cmdline w /proc/443/stat /proc/443/stat w /proc/564/stat /proc/564/stat w /proc/11/stat /proc/11/stat w /proc/19/stat /proc/19/stat w /proc/563/cmdline /proc/563/cmdline w /proc/21/cmdline /proc/21/cmdline w /proc/387/cmdline /proc/387/cmdline w /proc/161/stat /proc/161/stat w /proc/191/cmdline /proc/191/cmdline w /proc/1/stat /proc/1/stat w /proc/24/stat /proc/24/stat w /proc/359/cmdline /proc/359/cmdline w /proc/369/cmdline /proc/369/cmdline w /proc/447/cmdline /proc/447/cmdline w /proc/34/stat /proc/34/stat w /proc/161/cmdline /proc/161/cmdline w /proc/23/stat /proc/23/stat w /proc/29/stat /proc/29/stat w /proc/30/cmdline /proc/30/cmdline w /proc/31/stat /proc/31/stat w /proc/31/cmdline /proc/31/cmdline w /proc/78/stat /proc/78/stat w /proc/13/stat /proc/13/stat w /proc/21/stat /proc/21/stat w /proc/387/stat /proc/387/stat w /proc/479/stat /proc/479/stat w /proc/82/stat /proc/82/stat w /proc/97/cmdline /proc/97/cmdline w /proc/154/stat /proc/154/stat w /proc/158/stat /proc/158/stat w /proc/169/stat /proc/169/stat w /proc/300/stat /proc/300/stat w /proc/27/stat /proc/27/stat w /proc/29/cmdline /proc/29/cmdline w /proc/79/cmdline /proc/79/cmdline w /proc/159/cmdline /proc/159/cmdline w /proc/162/stat /proc/162/stat w /proc/249/cmdline /proc/249/cmdline w /proc/14/stat /proc/14/stat w /proc/28/stat /proc/28/stat w /proc/28/cmdline /proc/28/cmdline w /proc/151/stat /proc/151/stat w /proc/370/cmdline /proc/370/cmdline w /proc/701/stat /proc/701/stat w /proc/8/cmdline /proc/8/cmdline w /proc/25/cmdline /proc/25/cmdline w /proc/83/stat /proc/83/stat w /proc/165/stat /proc/165/stat w /proc/344/cmdline /proc/344/cmdline w /proc/416/stat /proc/416/stat w /proc/12/stat /proc/12/stat w /proc/79/stat /proc/79/stat w /proc/18/stat /proc/18/stat w /proc/18/cmdline /proc/18/cmdline w /proc/32/stat /proc/32/stat w /proc/34/cmdline /proc/34/cmdline w /proc/83/cmdline /proc/83/cmdline w /proc/114/stat /proc/114/stat w /proc/6/cmdline /proc/6/cmdline w /proc/17/stat /proc/17/stat w /proc/166/cmdline /proc/166/cmdline w /proc/349/cmdline /proc/349/cmdline w /proc/24/cmdline /proc/24/cmdline w /proc/152/stat /proc/152/stat w /proc/160/stat /proc/160/stat w /proc/191/stat /proc/191/stat w /proc/563/stat /proc/563/stat w /proc/10/cmdline /proc/10/cmdline w /proc/15/stat /proc/15/stat w /proc/114/cmdline /proc/114/cmdline w /proc/157/cmdline /proc/157/cmdline w /proc/343/cmdline /proc/343/cmdline w /proc/369/stat /proc/369/stat w /proc/loadavg /proc/loadavg w /proc/82/cmdline /proc/82/cmdline w /proc/84/cmdline /proc/84/cmdline w /proc/9/stat /proc/9/stat w /proc/23/cmdline /proc/23/cmdline w /proc/32/cmdline /proc/32/cmdline w /proc/35/cmdline /proc/35/cmdline w /proc/80/cmdline /proc/80/cmdline w /proc/302/cmdline /proc/302/cmdline w /proc/7/stat /proc/7/stat w /proc/14/cmdline /proc/14/cmdline w /proc/237/stat /proc/237/stat w /proc/345/stat /proc/345/stat w /proc/447/stat /proc/447/stat w /proc/20/stat /proc/20/stat w /proc/155/stat /proc/155/stat w /proc/26/cmdline /proc/26/cmdline w /proc/27/cmdline /proc/27/cmdline w /proc/163/stat /proc/163/stat w /proc/164/cmdline /proc/164/cmdline w /proc/190/stat /proc/190/stat w /proc/5/stat /proc/5/stat w /proc/17/cmdline /proc/17/cmdline w /proc/16/stat /proc/16/stat w /proc/20/cmdline /proc/20/cmdline w /proc/22/cmdline /proc/22/cmdline w /proc/26/stat /proc/26/stat w /proc/157/stat /proc/157/stat w /proc/344/stat /proc/344/stat w /proc/2/cmdline /proc/2/cmdline w /proc/12/cmdline /proc/12/cmdline w /proc/352/stat /proc/352/stat w /proc/701/cmdline /proc/701/cmdline w /proc/165/cmdline /proc/165/cmdline w /proc/249/stat /proc/249/stat w /proc/167/cmdline /proc/167/cmdline w /proc/343/stat /proc/343/stat w /proc/349/stat /proc/349/stat w /proc/561/stat /proc/561/stat w /proc/700/cmdline /proc/700/cmdline w /proc/25/stat /proc/25/stat w /proc/88/cmdline /proc/88/cmdline w /proc/88/stat /proc/88/stat w /proc/345/cmdline /proc/345/cmdline w /proc/699/cmdline /proc/699/cmdline w /proc/11/cmdline /proc/11/cmdline w /proc/35/stat /proc/35/stat w /proc/84/stat /proc/84/stat w /proc/154/cmdline /proc/154/cmdline w /proc/156/cmdline /proc/156/cmdline w /proc/7/cmdline /proc/7/cmdline w /proc/16/cmdline /proc/16/cmdline w /proc/30/stat /proc/30/stat w /proc/78/cmdline /proc/78/cmdline w /proc/80/stat /proc/80/stat w /proc/153/cmdline /proc/153/cmdline w /proc/155/cmdline /proc/155/cmdline w /proc/359/stat /proc/359/stat w /proc/loadavg /proc/loadavg uptime /proc/2/stat /proc/2/stat w /proc/370/stat /proc/370/stat w /proc/3/stat /proc/3/stat w /proc/4/stat /proc/4/stat w /proc/6/stat /proc/6/stat w /proc/15/cmdline /proc/15/cmdline w /proc/33/stat /proc/33/stat w /proc/152/cmdline /proc/152/cmdline w /proc/sys/kernel/osrelease /proc/sys/kernel/osrelease uptime /proc/sys/kernel/osrelease /proc/sys/kernel/osrelease w /proc/77/cmdline /proc/77/cmdline w /proc/81/cmdline /proc/81/cmdline w /proc/156/stat /proc/156/stat w /proc/477/stat /proc/477/stat w /proc/uptime /proc/uptime uptime /proc/10/stat /proc/10/stat w /proc/190/cmdline /proc/190/cmdline w /proc/352/cmdline /proc/352/cmdline w /proc/564/cmdline /proc/564/cmdline w /proc/1/cmdline /proc/1/cmdline w /proc/159/stat /proc/159/stat w
Processes
-
./vulcan.x64./vulcan.x641⤵PID:562
-
/bin/shsh -c "export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;uname -a;uptime"1⤵PID:696
-
/bin/unameuname -a2⤵PID:697
-
-
/usr/bin/uptimeuptime2⤵
- Reads CPU attributes
PID:698
-
-
/bin/shsh -c "export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;w"1⤵PID:700
-
/usr/bin/ww2⤵
- Reads CPU attributes
- Reads runtime system information
PID:701
-