Analysis
-
max time kernel
11803s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20221111-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
28-03-2023 08:47
Behavioral task
behavioral1
Sample
x86.elf
Resource
ubuntu1804-amd64-20221111-en
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
x86.elf
-
Size
54KB
-
MD5
a7e5bd2b6d08eb711cd5478d60199e71
-
SHA1
2f2c7995e84487cf2f056d7498623a29a6a35db3
-
SHA256
b838cef16faf264d4d082e56a112fc15bb5279163e3d6cb2641585beb62fe5a1
-
SHA512
492f8b03f61f2d3c88d35def10df0b5173afe9fca535e1e0d0cbada5f7adb8ca29fcce81af3e58858e0b35ae8a79fd73334d7427e30976d669e1400b41cb6997
-
SSDEEP
1536:JeESt/basV2rcZhG6ySN7nayRe9xzWOIaEjrqMms:JeESt/basVTgS7nayw9BtXESt
Score
9/10
Malware Config
Signatures
-
Contacts a large (37622) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes:
mkdirmvdescription ioc process /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems mv
Processes
-
/tmp/x86.elf/tmp/x86.elf1⤵
-
/bin/shsh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /ϋ���/tmp/x86.elfϋ���o\$ϋ� bin/systemd; chmod 777 bin/systemd"1⤵
-
/bin/rmrm -rf bin/systemd2⤵
-
/bin/mkdirmkdir bin2⤵
- Reads runtime system information
-
/bin/mvmv "/ϋ���/tmp/x86.elfϋ���o\$ϋ�" bin/systemd2⤵
- Reads runtime system information
-
/bin/chmodchmod 777 bin/systemd2⤵