b4eef4d7d44e532e496d59d19a5bef4833e4a0b2cbd3884d6378fb9d12bdf193

Analysis

max time kernel
11775s
max time network
135s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28-03-2023 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f42df781c510bae352fcd61629f30621eb300f5d495954636ceb2f817b47fdd4.elf
Size

140KB
MD5

0795290ee8634caeab4d8c88de21994f
SHA1

c0cea0ab841d7178f29aeec95e79e8c6cf0fc0f0
SHA256

f42df781c510bae352fcd61629f30621eb300f5d495954636ceb2f817b47fdd4
SHA512

5163e56b66854749946e207aced8646207d7f99dd48fb07de3782472ae3160c28c6a54a59e730e6bf2876a5b25d43c7d5c15ec41a91f10ce17488f00d4482642
SSDEEP

3072:K1gdBvfRaBNGYAXXpETbZOutJ8adPF4KQTjsV/43giCDebvfcivGmS+Qk:jaLSX5Y4utJ8adPF4fCqCDebvfci+mSy

Score

7^/10

persistence

Malware Config

Signatures

Modifies rc script 1 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
persistence

Boot or Logon Autostart Execution
T1547

Processes:

f42df781c510bae352fcd61629f30621eb300f5d495954636ceb2f817b47fdd4.elf

description ioc process

/etc/rc.d/rc.local /etc/rc.d/rc.local f42df781c510bae352fcd61629f30621eb300f5d495954636ceb2f817b47fdd4.elf
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

f42df781c510bae352fcd61629f30621eb300f5d495954636ceb2f817b47fdd4.elf

description ioc process

/proc/net/route /proc/net/route f42df781c510bae352fcd61629f30621eb300f5d495954636ceb2f817b47fdd4.elf
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

f42df781c510bae352fcd61629f30621eb300f5d495954636ceb2f817b47fdd4.elf

description ioc process

/proc/net/route /proc/net/route f42df781c510bae352fcd61629f30621eb300f5d495954636ceb2f817b47fdd4.elf

description	ioc	process
/etc/rc.d/rc.local	/etc/rc.d/rc.local	f42df781c510bae352fcd61629f30621eb300f5d495954636ceb2f817b47fdd4.elf

description	ioc	process
/proc/net/route	/proc/net/route	f42df781c510bae352fcd61629f30621eb300f5d495954636ceb2f817b47fdd4.elf

description	ioc	process
/proc/net/route	/proc/net/route	f42df781c510bae352fcd61629f30621eb300f5d495954636ceb2f817b47fdd4.elf

/tmp/f42df781c510bae352fcd61629f30621eb300f5d495954636ceb2f817b47fdd4.elf
/tmp/f42df781c510bae352fcd61629f30621eb300f5d495954636ceb2f817b47fdd4.elf
1⤵
- Modifies rc script
- Reads system routing table
- Reads system network configuration
PID:617

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads