a9275f22ab8c2e85acbad078d09dc65864fb1b5e652ca29d793bdb1a54c8a517

Analysis

max time kernel
0s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
16/02/2023, 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

log21.x86_64.elf
Size

42KB
MD5

64d6bcfeb27c5d5ad5aff154db90d90f
SHA1

491598475f2bbb4198dff332f4b194fd954a3529
SHA256

a9275f22ab8c2e85acbad078d09dc65864fb1b5e652ca29d793bdb1a54c8a517
SHA512

a94c2eeb3e4bd574b0ab5842829173aa5ebc8b7e3928583a2d263d5f665c09973658488d96f37fa106e0e10daf297aea0f753393b7065e49f83bc0ab83077137
SSDEEP

768:IYTQ0JxxcNUeBMvxfvZaK10P3WdwgtPTw88x17OWrZkpfIYF6x0x:IYTT5jxfvZQP3Wdwge8krr2iE

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (46945) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

description	ioc
/proc/net/tcp	/proc/net/tcp

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
/proc/net/tcp	/proc/net/tcp

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/357/fd	/proc/357/fd	Process not Found
/proc/391/fd	/proc/391/fd	Process not Found
/proc/586/fd	/proc/586/fd	Process not Found
/proc/	/proc/	Process not Found
/proc/1/fd	/proc/1/fd	Process not Found
/proc/308/fd	/proc/308/fd	Process not Found
/proc/350/fd	/proc/350/fd	Process not Found
/proc/609/fd	/proc/609/fd	Process not Found
/proc/263/fd	/proc/263/fd	Process not Found
/proc/351/fd	/proc/351/fd	Process not Found
/proc/384/fd	/proc/384/fd	Process not Found
/proc/451/fd	/proc/451/fd	Process not Found
/proc/355/fd	/proc/355/fd	Process not Found
/proc/362/fd	/proc/362/fd	Process not Found
/proc/371/fd	/proc/371/fd	Process not Found
/proc/428/fd	/proc/428/fd	Process not Found
/proc/431/fd	/proc/431/fd	Process not Found
/proc/450/fd	/proc/450/fd	Process not Found
/proc/filesystems	/proc/filesystems	mkdir
/proc/251/fd	/proc/251/fd	Process not Found
/proc/307/fd	/proc/307/fd	Process not Found
/proc/356/fd	/proc/356/fd	Process not Found
/proc/610/fd	/proc/610/fd	Process not Found

/tmp/log21.x86_64.elf
/tmp/log21.x86_64.elf
1⤵
PID:604
- /bin/sh
  sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/log21.x86_64.elf bin/watchdog; chmod 777 bin/watchdog"
  2⤵
  PID:605
- - /bin/rm
    rm -rf "bin/watchdog"
    3⤵
    PID:606
- - /bin/mkdir
    mkdir "bin"
    3⤵
    - Reads runtime system information
    PID:607
- - /bin/chmod
    chmod 777 bin/watchdog
    3⤵
    PID:608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads