Analysis
-
max time kernel
34359s -
max time network
153s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
10-01-2023 09:01
Behavioral task
behavioral1
Sample
[x86].elf
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
6 signatures
150 seconds
General
-
Target
[x86].elf
-
Size
301KB
-
MD5
925f81866adee5546e0fdd52fbc9261e
-
SHA1
2d18710c6c0d6a39ac905366ede7c80675050e1a
-
SHA256
bfc8c40a50c27a9b04d34fa84887a71e3672f5da9e5602506a137ae199a7638f
-
SHA512
f1db33b7122cb8ab39b640740b47e30a556f06440afa6e78b1da3d96af15caae19243a10c76aa0fc46afb4ebfd9c78ae45dfe77a84ee2e1a698466cc1e4a8a7b
-
SSDEEP
6144:SdYqcWBafIGaHqNsMQy1GgTKomE7Zi9O/DPw1KSYz1jcq:SdzcWBafjaVMQOmE7Zi9O/DPw1KSYz9L
Score
9/10
Malware Config
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 1 IoCs
description ioc /bin/watchdog /bin/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc /proc/net/tcp /proc/net/tcp -
Modifies rc script 1 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc /etc/rc.d/rc.local /etc/rc.d/rc.local -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc /proc/net/tcp /proc/net/tcp -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process /proc/27/cmdline /proc/27/cmdline Process not Found /proc/85/maps /proc/85/maps Process not Found /proc/250/cmdline /proc/250/cmdline Process not Found /proc/366/maps /proc/366/maps Process not Found /proc/595/cmdline /proc/595/cmdline Process not Found /proc/2/maps /proc/2/maps Process not Found /proc/3/maps /proc/3/maps Process not Found /proc/79/cmdline /proc/79/cmdline [x86].elf /proc/167/cmdline /proc/167/cmdline [x86].elf /proc/13/cmdline /proc/13/cmdline Process not Found /proc/19/cmdline /proc/19/cmdline Process not Found /proc/36/cmdline /proc/36/cmdline Process not Found /proc/10/cmdline /proc/10/cmdline [x86].elf /proc/9/maps /proc/9/maps Process not Found /proc/21/maps /proc/21/maps Process not Found /proc/83/cmdline /proc/83/cmdline Process not Found /proc/163/cmdline /proc/163/cmdline Process not Found /proc/169/maps /proc/169/maps Process not Found /proc/178/maps /proc/178/maps Process not Found /proc/16/cmdline /proc/16/cmdline [x86].elf /proc/32/cmdline /proc/32/cmdline Process not Found /proc/78/cmdline /proc/78/cmdline Process not Found /proc/79/maps /proc/79/maps Process not Found /proc/176/maps /proc/176/maps Process not Found /proc/352/maps /proc/352/maps Process not Found /proc/586/cmdline /proc/586/cmdline Process not Found /proc/591/cmdline /proc/591/cmdline Process not Found /proc/81/cmdline /proc/81/cmdline [x86].elf /proc/176/cmdline /proc/176/cmdline [x86].elf /proc/self/cmdline /proc/self/cmdline Process not Found /proc/175/maps /proc/175/maps Process not Found /proc/382/maps /proc/382/maps Process not Found /proc/598/cmdline /proc/598/cmdline Process not Found /proc/32/cmdline /proc/32/cmdline [x86].elf /proc/352/cmdline /proc/352/cmdline [x86].elf /proc/ /proc/ Process not Found /proc/30/cmdline /proc/30/cmdline Process not Found /proc/333/cmdline /proc/333/cmdline Process not Found /proc/565/maps /proc/565/maps Process not Found /proc/7/cmdline /proc/7/cmdline [x86].elf /proc/35/cmdline /proc/35/cmdline [x86].elf /proc/179/cmdline /proc/179/cmdline [x86].elf /proc/34/maps /proc/34/maps Process not Found /proc/115/maps /proc/115/maps Process not Found /proc/165/cmdline /proc/165/cmdline Process not Found /proc/202/cmdline /proc/202/cmdline Process not Found /proc/331/cmdline /proc/331/cmdline Process not Found /proc/26/cmdline /proc/26/cmdline [x86].elf /proc/262/cmdline /proc/262/cmdline [x86].elf /proc/6/cmdline /proc/6/cmdline Process not Found /proc/28/cmdline /proc/28/cmdline Process not Found /proc/23/cmdline /proc/23/cmdline [x86].elf /proc/366/cmdline /proc/366/cmdline [x86].elf /proc/14/maps /proc/14/maps Process not Found /proc/26/cmdline /proc/26/cmdline Process not Found /proc/164/cmdline /proc/164/cmdline Process not Found /proc/174/maps /proc/174/maps Process not Found /proc/262/cmdline /proc/262/cmdline Process not Found /proc/333/cmdline /proc/333/cmdline [x86].elf /proc/164/cmdline /proc/164/cmdline [x86].elf /proc/18/maps /proc/18/maps Process not Found /proc/26/maps /proc/26/maps Process not Found /proc/331/maps /proc/331/maps Process not Found /proc/596/cmdline /proc/596/cmdline Process not Found