c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c

Analysis

max time kernel
0s
max time network
102s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
15-11-2022 13:07

Target

c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c.elf
Size

30KB
MD5

b65d8705c8d30ccc855e0dc48f093591
SHA1

27fc5359c0200cb33b328048d317605c255db6ea
SHA256

c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c
SHA512

feb559ae57b67858b3a98a5e71fe04a4dd18881043ac291263ad6513d542b7c02a307fdcb0d6fd50eaddb34356ac02f346d2c0f19fe39364f239ae4e84236345
SSDEEP

384:lL1X7ng7ou6PJOK8Ik93KRqPuaXhUp/GDUIMmoMyV4Mnmo0iFZZ6nvpm2HQF8YA7:lLtb6yo93Xk/gvMNMy10iFZZAmJBA7

Score

5^/10

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	cp

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c.elf	/tmp/c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c.elf	cp

/tmp/c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c.elf
/tmp/c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c.elf
1⤵
PID:581
- /bin/sh
  sh -c "/bin/rm -f /var/lock/kdumpflush;/bin/cp /tmp/c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c.elf /var/lock/kdumpflush && /bin/chmod 755 /var/lock/kdumpflush && /var/lock/kdumpflush --init"
  2⤵
  PID:582
- - /bin/rm
    /bin/rm -f /var/lock/kdumpflush
    3⤵
    PID:583
- - /bin/cp
    /bin/cp /tmp/c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c.elf /var/lock/kdumpflush
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:584
- - /bin/chmod
    /bin/chmod 755 /var/lock/kdumpflush
    3⤵
    PID:585
- - /var/lock/kdumpflush
    /var/lock/kdumpflush --init
    3⤵
    PID:586