Analysis
-
max time kernel
0s -
max time network
154s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
26-08-2022 20:46
Behavioral task
behavioral1
Sample
supercat.x86
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
supercat.x86
-
Size
61KB
-
MD5
f0cf2f35ac09ed4d1e92f450b68c9703
-
SHA1
d5f73e6ba5d640ad2c37dec36fc006bd278cc185
-
SHA256
7898b1e87830c0cceab236123907d0e9b8e26567be3f0da1ef8a33a5dcd8a7e4
-
SHA512
647129f2be7af4da86943f1ef6ec27bf84c067b88a821e691ae366d8d24d8790311a98cbafe517118b014851f96dc9e03036a3e7df9903f6ba05037993a5689f
-
SSDEEP
1536:C9WkmPxuvQNBExxx7oNEDm+1uq9LM5kSkfzNkera6:WWkmPx/OD7iEDmyuqkkr5kj6
Score
9/10
Malware Config
Signatures
-
Contacts a large (23504) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
description ioc Process /proc/filesystems /proc/filesystems mv /proc/filesystems /proc/filesystems mkdir
Processes
-
/tmp/supercat.x86/tmp/supercat.x861⤵PID:581
-
/bin/shsh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/supercat.x86 bin/busybox; chmod 777 bin/busybox"1⤵PID:582
-
/bin/rmrm -rf bin/busybox2⤵PID:583
-
-
/bin/mkdirmkdir bin2⤵
- Reads runtime system information
PID:584
-
-
/bin/mvmv /tmp/supercat.x86 bin/busybox2⤵
- Reads runtime system information
PID:585
-
-
/bin/chmodchmod 777 bin/busybox2⤵PID:586
-