31a13b6b7f6b63c34bdf7f68153dceffb93b022374940aeecea5238de1b16dcc

Analysis

max time kernel
0s
max time network
153s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
27/03/2023, 07:25

Target

4206a52c7ffedbb3ea34369e7cc35413.elf
Size

54KB
MD5

4206a52c7ffedbb3ea34369e7cc35413
SHA1

3ff829e51618b8a76eb46dad9e8697fb6962f834
SHA256

31a13b6b7f6b63c34bdf7f68153dceffb93b022374940aeecea5238de1b16dcc
SHA512

40872c53b022d84945097bf2ae198101b946f9a99ca95449a4fd09ac68c23c7716d4211cfd8fe072374ddcb15d0a3a9d2060dca78a218e21cbb08ade12aa1dad
SSDEEP

1536:JeESt/basV2rcZhG6+KN7TqppW1ZzWOIaEjrqMVs:JeESt/basVTgW7Tqpw1ptXESG

Score

9^/10

discovery

Contacts a large (37625) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	mkdir

/tmp/4206a52c7ffedbb3ea34369e7cc35413.elf
/tmp/4206a52c7ffedbb3ea34369e7cc35413.elf
1⤵
PID:612

/bin/sh
sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog��/��A�� && mv /tmp/4206a52c7ffedbb3ea34369e7cc35413.elf bin/watchdog; chmod 777 bin/watchdog"
1⤵
PID:613
- /bin/rm
  rm -rf bin/watchdog
  2⤵
  PID:614
- /bin/mkdir
  mkdir bin
  2⤵
  - Reads runtime system information
  PID:615
- /bin/chmod
  chmod 777 "bin/watchdog"
  2⤵
  PID:616

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact