Analysis
-
max time kernel
0s -
max time network
152s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
-
submitted
08/10/2022, 07:04
General
-
Target
488693c73ec587778154f47f007f4e40.elf
-
Size
85KB
-
MD5
488693c73ec587778154f47f007f4e40
-
SHA1
7ccda453958f3b8208df751dfebdf25dc6577be0
-
SHA256
a4afdda35824398c3753915141f70039cc5dbb7f523ba3567751a969e625e4a3
-
SHA512
1a3f0567c247c012b2d32b846be4fb77b1aa80c01dda62d2bb6a6afa5fcef9d4369231524a9a3d3774bda626ad06b2a3c6bbd5953248306efdf929a68b945a74
-
SSDEEP
1536:QuYdpAndRnorvIugK8ZSBZEjeR3p353lfpxai31bmaIQN1nsdUZGIS:BYdynorpgK8ZCZEk3p3JlRVbmdQN1nAH
Score
9/10
Malware Config
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/488693c73ec587778154f47f007f4e40.elf/tmp/488693c73ec587778154f47f007f4e40.elf1⤵
- Reads system routing table
- Reads system network configuration