Overview

overview

10

Static

static

10

Ghost.q.elf

ubuntu-18.04-amd64

9

Analysis

  • max time kernel
    0s
  • max time network
    25s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    21-09-2022 21:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Ghost.q.elf

  • Size

    596KB

  • MD5

    8e6961210d82ddd5bdd636bbf68593a3

  • SHA1

    9538b70c08b272fce9f3b25ff06c8828fdcb0175

  • SHA256

    34d70d58eae0338f35488d9a05ac5d703db7aa97699e9365d85e9a843d7c4979

  • SHA512

    f39142f568e4c3de66f48ba50552480a604d3a16287de0c1f14d2893c9eb0fdf39a80abcedd54294f5b8f9daf9ca62e9b08408e84a08b834ed36e905486bd85b

  • SSDEEP

    12288:rPTJS+naeW9kclFEcMWbHdxZ7GkR2fX/6y9P/YAh7Dxu9hc7D:DTJfrW99q4bHdxZ7G1fXFND4XcX

Score
9/10
persistence

Malware Config

Signatures

  • Writes file to system bin folder 1 TTPs 4 IoCs
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  • Modifies rc script 1 TTPs 12 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence