Analysis
-
max time kernel
0s -
max time network
134s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20221111-en -
resource tags
-
submitted
15-11-2022 13:07
General
-
Target
97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc.elf
-
Size
28KB
-
MD5
5fda35bd30be1cc21f8e933e41a88d9b
-
SHA1
8535c3b18a10649b94531c6d9f79750324498e5c
-
SHA256
97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc
-
SHA512
1a0f9a5a5a6d3cdf1b5d71dda8f111e8f6b6d4378d3e1fe4c7797bcea3642fced6dd7ec398b8fbe0a108a4d63d00191ff80893eeeeaebb7b637fb17e41220ec6
-
SSDEEP
384:kmdtqD0ogKS6afykzoSPAB5f0IbMCfZS3Fz8WdGnzv0iFXkTg3YUq8wz0H:kYtqD0ousSPSHbDRS3aWdgv0iFOUq8HH
Score
7/10
Malware Config
Signatures
-
Writes file to shm directory 3 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc.elf/tmp/97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc.elf1⤵
-
/bin/shsh -c "/bin/rm -f /dev/shm/kdmtmpflush;/bin/cp /tmp/97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc.elf /dev/shm/kdmtmpflush && /bin/chmod 755 /dev/shm/kdmtmpflush && /dev/shm/kdmtmpflush --init && /bin/rm -f /dev/shm/kdmtmpflush"2⤵
-
/bin/rm/bin/rm -f /dev/shm/kdmtmpflush3⤵
- Writes file to shm directory
-
/bin/cp/bin/cp /tmp/97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc.elf /dev/shm/kdmtmpflush3⤵
- Writes file to shm directory
- Reads runtime system information
- Writes file to tmp directory
-
/bin/chmod/bin/chmod 755 /dev/shm/kdmtmpflush3⤵
-
/dev/shm/kdmtmpflush/dev/shm/kdmtmpflush --init3⤵
-
/bin/rm/bin/rm -f /dev/shm/kdmtmpflush3⤵
- Writes file to shm directory