Analysis
-
max time kernel
11803s -
max time network
153s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20221111-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
28-03-2023 08:56
Behavioral task
behavioral1
Sample
x86.elf
Resource
ubuntu1804-amd64-20221111-en
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
x86.elf
-
Size
57KB
-
MD5
1dc464866d71c58a2a19d66a0a0450c9
-
SHA1
c6aef84d1941981f5d54781973414fb0cc637e7f
-
SHA256
c693531354b88880359aa488f7c498a6952d66e9ab3a6bc66dc7f3769e9d4d59
-
SHA512
0c720f6957025dadbbd0c52979c318c942510061b258cedd7effda0f14d50932a42d7604ec06c671127630dc0dc7e4113adac1da2ead972a40b43c0d15c454e9
-
SSDEEP
1536:ka4CVvtTO88JT/0fSGUzU+EYeZ56V/Ps06r6Mv:d4CxtTO88d/0KGUw+EvZw9k0Jk
Score
9/10
Malware Config
Signatures
-
Contacts a large (37368) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes:
mkdirmvdescription ioc process /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems mv
Processes
-
/tmp/x86.elf/tmp/x86.elf1⤵
-
/bin/shsh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv u7�!���!��/tmp/x86.elf!����� �!�� bin/busybox; chmod 777 bin/busybox"1⤵
-
/bin/rmrm -rf bin/busybox2⤵
-
/bin/mkdirmkdir bin2⤵
- Reads runtime system information
-
/bin/mvmv "u7�!���!��/tmp/x86.elf!�����" "�!��" bin/busybox2⤵
- Reads runtime system information
-
/bin/chmodchmod 777 bin/busybox2⤵