Analysis
-
max time kernel
0s -
max time network
155s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
18-08-2022 19:30
Behavioral task
behavioral1
Sample
3906e86b3d3cd108cbf0468c22ece6b4
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
3906e86b3d3cd108cbf0468c22ece6b4
-
Size
140KB
-
MD5
3906e86b3d3cd108cbf0468c22ece6b4
-
SHA1
99e7dc85f8ef2903141add2db03d0155d5ab5e7f
-
SHA256
ac09345ea9d162a8299f848d99cad3bb84fca444c24799efceaabbc7fd1a9c85
-
SHA512
70a8c5a47d51afe12f3c4b2bafadfa586fa95f68794a39c0630dfd7af28905263e60434a271c155faa03c4dcfe0758e0b6777c4f5e9b33ec2f24db427a90696d
Malware Config
Signatures
-
Contacts a large (69092) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
Processes:
3906e86b3d3cd108cbf0468c22ece6b4description ioc process /proc/net/route /proc/net/route 3906e86b3d3cd108cbf0468c22ece6b4 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
3906e86b3d3cd108cbf0468c22ece6b4description ioc process /proc/net/route /proc/net/route 3906e86b3d3cd108cbf0468c22ece6b4 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc /proc/469/ /proc/469/ /proc/509/ /proc/509/ /proc/562/ /proc/562/ /proc/589/exe /proc/589/exe /proc/589/maps /proc/589/maps /proc/429/ /proc/429/ /proc/477/ /proc/477/ /proc/570/ /proc/570/ /proc/585/maps /proc/585/maps /proc/510/ /proc/510/ /proc/528/ /proc/528/ /proc/585/ /proc/585/ /proc/514/ /proc/514/ /proc/555/ /proc/555/ /proc/568/ /proc/568/ /proc/417/exe /proc/417/exe /proc/487/ /proc/487/ /proc/446/ /proc/446/ /proc/452/ /proc/452/ /proc/472/ /proc/472/ /proc/497/ /proc/497/ /proc/505/ /proc/505/ /proc/537/ /proc/537/ /proc/559/ /proc/559/ /proc/439/ /proc/439/ /proc/524/ /proc/524/ /proc/436/ /proc/436/ /proc/483/ /proc/483/ /proc/515/ /proc/515/ /proc/544/ /proc/544/ /proc/577/ /proc/577/ /proc/404/ /proc/404/ /proc/564/ /proc/564/ /proc/433/ /proc/433/ /proc/484/ /proc/484/ /proc/506/ /proc/506/ /proc/443/ /proc/443/ /proc/496/ /proc/496/ /proc/538/ /proc/538/ /proc/560/ /proc/560/ /proc/579/exe /proc/579/exe /proc/440/ /proc/440/ /proc/494/ /proc/494/ /proc/551/ /proc/551/ /proc/561/ /proc/561/ /proc/438/ /proc/438/ /proc/453/ /proc/453/ /proc/468/ /proc/468/ /proc/493/ /proc/493/ /proc/425/ /proc/425/ /proc/588/exe /proc/588/exe /proc/408/ /proc/408/ /proc/422/ /proc/422/ /proc/424/ /proc/424/ /proc/442/ /proc/442/ /proc/518/ /proc/518/ /proc/579/maps /proc/579/maps /proc/539/ /proc/539/ /proc/543/ /proc/543/ /proc/590/ /proc/590/ /proc/503/ /proc/503/ /proc/435/ /proc/435/ /proc/481/ /proc/481/ /proc/548/ /proc/548/