2c8f2cd14cc4456efa6cee74089b3e97363d0ea33bc809eb091fc0c0d39efe5b

Analysis

max time kernel
6452s
max time network
101s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
25-01-2023 10:38

Target

400.184/mods
Size

23.7MB
MD5

39c86e0c3102034f7ae30e653e3afeba
SHA1

ccfd6c1570473e4851ebf255a8519c8ad8c9f1da
SHA256

4af640f74e44fc56aefe76d6d36ee3070e4304c8844b5d73028269f3845d2e56
SHA512

4df53717a9742a8540f042352bab6a13bd2848cf3b776643dc4a461985daef1c7ba78cd6dd9cb7d7ac8478cc8ed86342ebeb1793bf8d918a7590c504d072d1da
SSDEEP

393216:lOlQz0IDS/EJRpgvVjhYuzbrHkAERJj/HCmcansl4WySvd3Lg5jCQ13QFyEiRdR:4lQzH4ESVjhhXrkAC/HPcaQt7iBW3iRf

Score

5^/10

Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.

Processes:

mods

description ioc process

/proc/modules /proc/modules mods
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

sh

description ioc process

/tmp/400.184/install_module.sh /tmp/400.184/install_module.sh sh

description	ioc	process
/proc/modules	/proc/modules	mods

description	ioc	process
/tmp/400.184/install_module.sh	/tmp/400.184/install_module.sh	sh

/tmp/400.184/mods
/tmp/400.184/mods
1⤵
- Reads runtime system information
PID:637

/bin/sh
sh /tmp/400.184/install_module.sh --insert
3⤵
- Writes file to tmp directory
PID:718