Analysis
-
max time kernel
152s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20230621-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20230621-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
10-07-2023 20:35
Static task
static1
Behavioral task
behavioral1
Sample
most-x86-20230710-2034.elf
Resource
ubuntu1804-amd64-20230621-en
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
most-x86-20230710-2034.elf
-
Size
85KB
-
MD5
9a14aba85870d75db3aa545d0a611487
-
SHA1
65f5a4c0b5cf29881542160a8027f1c77394f9b3
-
SHA256
8ca7ff2af1135c8e62425fc61f92cfdd1724c1fe240e922f2d4a2bd8d5355af2
-
SHA512
e46f440f40aa4c6787b3d7b7604f2d383e4c7b5b664744cb61dc2a5d252238ea61d818e84533ee4ac131ec37daba18aca5ad8b8fb4742b739549b66812cabafe
-
SSDEEP
1536:+gXuW4LiQGm2y8SuAg98M5SKKyp3wO7QU7Bs+Sb4q:+gXQOQGm2tSu5SitKyp3n7hin5
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 598 most-x86-20230710-2034.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/79/cmdline File opened for reading /proc/371/cmdline File opened for reading /proc/620/cmdline File opened for reading /proc/627/cmdline File opened for reading /proc/699/cmdline File opened for reading /proc/7/cmdline File opened for reading /proc/8/cmdline File opened for reading /proc/29/cmdline File opened for reading /proc/631/cmdline File opened for reading /proc/639/cmdline File opened for reading /proc/698/cmdline File opened for reading /proc/353/cmdline File opened for reading /proc/607/cmdline File opened for reading /proc/613/cmdline File opened for reading /proc/605/cmdline File opened for reading /proc/610/cmdline File opened for reading /proc/621/cmdline File opened for reading /proc/635/cmdline File opened for reading /proc/659/cmdline File opened for reading /proc/163/cmdline File opened for reading /proc/375/cmdline File opened for reading /proc/446/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/155/cmdline File opened for reading /proc/595/cmdline File opened for reading /proc/634/cmdline File opened for reading /proc/685/cmdline File opened for reading /proc/711/cmdline File opened for reading /proc/721/cmdline File opened for reading /proc/2/cmdline File opened for reading /proc/593/cmdline File opened for reading /proc/596/cmdline File opened for reading /proc/170/cmdline File opened for reading /proc/609/cmdline File opened for reading /proc/616/cmdline File opened for reading /proc/678/cmdline File opened for reading /proc/692/cmdline File opened for reading /proc/1/cmdline File opened for reading /proc/13/cmdline File opened for reading /proc/81/cmdline File opened for reading /proc/710/cmdline File opened for reading /proc/648/cmdline File opened for reading /proc/679/cmdline File opened for reading /proc/683/cmdline File opened for reading /proc/6/cmdline File opened for reading /proc/333/cmdline File opened for reading /proc/614/cmdline File opened for reading /proc/702/cmdline File opened for reading /proc/709/cmdline File opened for reading /proc/647/cmdline File opened for reading /proc/650/cmdline File opened for reading /proc/674/cmdline File opened for reading /proc/668/cmdline File opened for reading /proc/127/cmdline File opened for reading /proc/162/cmdline File opened for reading /proc/287/cmdline File opened for reading /proc/447/cmdline File opened for reading /proc/644/cmdline File opened for reading /proc/677/cmdline File opened for reading /proc/10/cmdline File opened for reading /proc/89/cmdline File opened for reading /proc/288/cmdline File opened for reading /proc/98/cmdline File opened for reading /proc/575/cmdline