ceb503189360c97b79ab8e6bd2d8ea452bdaa2f5b8a1caa7dca3e639d71c8697

Analysis

max time kernel
8323s
max time network
153s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
16-02-2023 02:18

Target

d23c943cdb07744ec8d7cc82028966dd.elf
Size

54KB
MD5

d23c943cdb07744ec8d7cc82028966dd
SHA1

a229784c46247c40074d4ea92ead1f70a39c0b7a
SHA256

ceb503189360c97b79ab8e6bd2d8ea452bdaa2f5b8a1caa7dca3e639d71c8697
SHA512

41ba2af4b6bfaa54d28e018f27977d96df306dc7194b55510cbed0d78e00b1cd98a61f82887a87b9e627b0b41e52cd1151a16faaa57f40990598dfd0547c173a
SSDEEP

1536:JeESt/basV2rcZhG6ySN7naopW1ZzWOIaEjrqMUs:JeESt/basVTgS7naow1ptXESb

Score

9^/10

discovery

Contacts a large (37627) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	mkdir

/tmp/d23c943cdb07744ec8d7cc82028966dd.elf
/tmp/d23c943cdb07744ec8d7cc82028966dd.elf
1⤵
PID:585

/bin/sh
sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog9��/�9��a9�� && mv /tmp/d23c943cdb07744ec8d7cc82028966dd.elf bin/watchdog; chmod 777 bin/watchdog"
1⤵
PID:586
- /bin/rm
  rm -rf bin/watchdog
  2⤵
  PID:587
- /bin/mkdir
  mkdir bin
  2⤵
  - Reads runtime system information
  PID:588
- /bin/chmod
  chmod 777 "bin/watchdog"
  2⤵
  PID:589

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact