ca87a3ca2761ca572ac23a7c6ef66a4f83976f334489bb6df823a1bf22e63dc4

Analysis

max time kernel
0s
max time network
154s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
26/09/2022, 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tamkjll.x86_64.elf
Size

79KB
MD5

4a865a3d87e0824e137d0e5f6bffb2c2
SHA1

ef71750fe8afeae9d0c0a0ebb463f1b28058b489
SHA256

ca87a3ca2761ca572ac23a7c6ef66a4f83976f334489bb6df823a1bf22e63dc4
SHA512

390c6074cfe94c34e3f19221812124a557a1f0bb1775a8b13c4bf9c79a1341d3501b890c4eda9bd63ece343df73bc048d7f452719cfc23611c3aa6cb39bc0025
SSDEEP

1536:a8uepVCfrxgeHce0xiCKigGYa+Kcybyu8HT600RoRVsFJysSU50V:aaVOrxgeHJ6iCKigGT7cE6HO0JRVsCsi

Score

7^/10

Malware Config

Signatures

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

description	ioc
/proc/net/tcp	/proc/net/tcp

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
/proc/net/tcp	/proc/net/tcp

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	mv
/proc/251/fd	/proc/251/fd	Process not Found
/proc/287/fd	/proc/287/fd	Process not Found
/proc/345/fd	/proc/345/fd	Process not Found
/proc/358/fd	/proc/358/fd	Process not Found
/proc/372/fd	/proc/372/fd	Process not Found
/proc/425/fd	/proc/425/fd	Process not Found
/proc/1/fd	/proc/1/fd	Process not Found
/proc/360/fd	/proc/360/fd	Process not Found
/proc/361/fd	/proc/361/fd	Process not Found
/proc/586/fd	/proc/586/fd	Process not Found
/proc/359/fd	/proc/359/fd	Process not Found
/proc/453/fd	/proc/453/fd	Process not Found
/proc/	/proc/	Process not Found
/proc/221/fd	/proc/221/fd	Process not Found
/proc/252/fd	/proc/252/fd	Process not Found
/proc/285/fd	/proc/285/fd	Process not Found
/proc/342/fd	/proc/342/fd	Process not Found
/proc/364/fd	/proc/364/fd	Process not Found
/proc/379/fd	/proc/379/fd	Process not Found
/proc/423/fd	/proc/423/fd	Process not Found
/proc/451/fd	/proc/451/fd	Process not Found
/proc/587/fd	/proc/587/fd	Process not Found

/tmp/tamkjll.x86_64.elf
/tmp/tamkjll.x86_64.elf
1⤵
PID:580

/bin/sh
sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/tamkjll.x86_64.elf bin/watchdog; chmod 777 bin/watchdog"
1⤵
PID:581
- /bin/rm
  rm -rf bin/watchdog
  2⤵
  PID:582
- /bin/mkdir
  mkdir bin
  2⤵
  - Reads runtime system information
  PID:583
- /bin/mv
  mv /tmp/tamkjll.x86_64.elf bin/watchdog
  2⤵
  - Reads runtime system information
  PID:584
- /bin/chmod
  chmod 777 bin/watchdog
  2⤵
  PID:585

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...