Analysis
-
max time kernel
0s -
max time network
134s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20221111-en -
resource tags
-
submitted
15-11-2022 13:05
General
-
Target
4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d.elf
-
Size
27KB
-
MD5
156226c90974180cc4b5f9738e80f1f8
-
SHA1
ed0cd45c3bb95ef8da214048799395e247040d17
-
SHA256
4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d
-
SHA512
8915d1e0a42d8981b0260458a1d9769a29d45fcdd35f238caacbe7ffe8b6aa711c56c0b3afc550c0c33c58dc07ed0ba2444457dcc45665cb15d50f07fc9b82b6
-
SSDEEP
768:vtDPYOFMXrThYxt+2ZcMyObDRSDfPrgd0iFngrJ+et:RPYOFMXrThYxttcMyOh0iFgrMe
Score
5/10
Malware Config
Signatures
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d.elf/tmp/4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d.elf1⤵
-
/bin/shsh -c "/bin/rm -f /var/lock/kdumpflush;/bin/cp /tmp/4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d.elf /var/lock/kdumpflush && /bin/chmod 755 /var/lock/kdumpflush && /var/lock/kdumpflush --init"2⤵
-
/bin/rm/bin/rm -f /var/lock/kdumpflush3⤵
-
/bin/cp/bin/cp /tmp/4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d.elf /var/lock/kdumpflush3⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/chmod/bin/chmod 755 /var/lock/kdumpflush3⤵
-
/var/lock/kdumpflush/var/lock/kdumpflush --init3⤵