d56b01cd17ce33041c6c8580a21142959b96cd15e2d669ed683701a602320d24

Analysis

max time kernel
142s
max time network
148s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
29/05/2023, 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TRC.x86.elf
Size

42KB
MD5

828c98f8badbc454e23fda1452d059fb
SHA1

2e4a85164d0feec38248cc7857d9de7026393023
SHA256

d56b01cd17ce33041c6c8580a21142959b96cd15e2d669ed683701a602320d24
SHA512

3687e0f6213d910a6bc14b9f53be4ade8a27a62d3958bb2c6cf800b2daedfd10dc7f7a26dc6b09fd3a8c1b35453086cb4922a05bfa8c31a10ff1d6614b4dc9e7
SSDEEP

768:AdjgKRk+hJeQby4WIY/WXoKmY3Mgi+XxGU/ObPqgFD+EeoV:Ad0KRk+hJeQby4WIY/+o1Y3MgiEs/7qN

Score

7^/10

Malware Config

Signatures

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	598	TRC.x86.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

description	ioc
File opened for reading	/proc/net/tcp

Enumerates running processes
Discovers information about currently running processes on the system

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
File opened for reading	/proc/net/tcp

Reads runtime system information 36 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/381/fd
File opened for reading	/proc/596/exe
File opened for reading	/proc/603/exe
File opened for reading	/proc/1/fd
File opened for reading	/proc/367/fd
File opened for reading	/proc/374/fd
File opened for reading	/proc/593/fd
File opened for reading	/proc/412/exe
File opened for reading	/proc/263/fd
File opened for reading	/proc/357/fd
File opened for reading	/proc/601/fd
File opened for reading	/proc/576/exe
File opened for reading	/proc/594/exe
File opened for reading	/proc/358/fd
File opened for reading	/proc/447/exe
File opened for reading	/proc/450/exe
File opened for reading	/proc/309/fd
File opened for reading	/proc/344/fd
File opened for reading	/proc/366/fd
File opened for reading	/proc/450/fd
File opened for reading	/proc/576/fd
File opened for reading	/proc/427/exe
File opened for reading	/proc/245/fd
File opened for reading	/proc/307/fd
File opened for reading	/proc/447/fd
File opened for reading	/proc/599/fd
File opened for reading	/proc/599/exe
File opened for reading	/proc/602/exe
File opened for reading	/proc/595/exe
File opened for reading	/proc/604/exe
File opened for reading	/proc/346/fd
File opened for reading	/proc/602/fd
File opened for reading	/proc/615{1,1T
File opened for reading	/proc/424/exe
File opened for reading	/proc/593/exe
File opened for reading	/proc/356/fd

/tmp/TRC.x86.elf
/tmp/TRC.x86.elf
1⤵
- Changes its process name
PID:598

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...