c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276

Analysis

max time kernel
0s
max time network
103s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
15-11-2022 13:08

Target

c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276.elf
Size

22KB
MD5

87223f2a9c3a65be7545f25f95e10ece
SHA1

92439c3c736a0554883118ecfe082b27aa6c9143
SHA256

c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276
SHA512

eeeb9522294c9785074cd318118e43db13b165a242460bfeae34047b89eece3bf8cd128afb11c6440cb9d7845d6ba14c814bf9a477caffe7167d3a5c5e427c21
SSDEEP

384:Vmdt5D0ogBSoafTZKuZkBAzspIbMCfZSDFM6HlYGxhq0iFEcTGWYSVs:VYt5D0ozZfIabDRSD2wlYgq0iFkSO

Score

5^/10

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	cp

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276.elf	/tmp/c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276.elf	cp

/tmp/c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276.elf
/tmp/c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276.elf
1⤵
PID:577
- /bin/sh
  sh -c "/bin/rm -f /var/lock/kdumpflush;/bin/cp /tmp/c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276.elf /var/lock/kdumpflush && /bin/chmod 755 /var/lock/kdumpflush && /var/lock/kdumpflush --init"
  2⤵
  PID:578
- - /bin/rm
    /bin/rm -f /var/lock/kdumpflush
    3⤵
    PID:579
- - /bin/cp
    /bin/cp /tmp/c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276.elf /var/lock/kdumpflush
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:580
- - /bin/chmod
    /bin/chmod 755 /var/lock/kdumpflush
    3⤵
    PID:581
- - /var/lock/kdumpflush
    /var/lock/kdumpflush --init
    3⤵
    PID:582