Analysis
-
max time kernel
0s -
max time network
25s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20221111-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
26-03-2023 04:56
Behavioral task
behavioral1
Sample
x86
Resource
ubuntu1804-amd64-20221111-en
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
x86
-
Size
54KB
-
MD5
db80751834267cafc820d1f8ee9530ae
-
SHA1
f5d53bb12b0c019099909c2c7476b815144c5a4f
-
SHA256
3130fb91361382555834e1e4906d8c013931dd96515dfb5650f5fa31847e7736
-
SHA512
e2c0c1f5aa9dfe275f3f47dafb4eedda1e4190961f0db267e4c76eec1706a2bb09be8b682628b01e41959f04ee74a5dc6ce6c477fff3ddbeedf1fdd88c59d8d6
-
SSDEEP
1536:JeESt/basV2rcZhG6ySN7naxtad1zWOIaEjrqM4s:JeESt/basVTgS7naxQdttXESP
Score
9/10
Malware Config
Signatures
-
Contacts a large (5633) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes:
mkdirmvdescription ioc process /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems mv
Processes
-
/tmp/x86/tmp/x861⤵PID:603
-
/bin/shsh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /����1���/tmp/x86 bin/systemd����; chmod 777 bin/systemd"1⤵PID:604
-
/bin/rmrm -rf bin/systemd2⤵PID:605
-
/bin/mkdirmkdir bin2⤵
- Reads runtime system information
PID:606 -
/bin/mvmv "/����1���/tmp/x86" "bin/systemd����"2⤵
- Reads runtime system information
PID:607 -
/bin/chmodchmod 777 bin/systemd2⤵PID:608