Analysis
-
max time kernel
93s -
max time network
122s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20230621-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20230621-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04-08-2023 08:59
Behavioral task
behavioral1
Sample
27822be7809142a1c359312b6f5ab6a2.elf
Resource
ubuntu1804-amd64-20230621-en
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
27822be7809142a1c359312b6f5ab6a2.elf
-
Size
16.9MB
-
MD5
27822be7809142a1c359312b6f5ab6a2
-
SHA1
81af90eed795025c48bca6c8b0b278361f0d977b
-
SHA256
48a70bd18a23fce3208195f4ad2e92fce78d37eeaa672f83af782656a4b2d07f
-
SHA512
09952a96d35787bf356e7ee93fad46f47e1726c0a3f6c7a0ed5cd084085935feeac422c9a1d236965ec3cdc73125f9d3dca9d7e8a0dd05be5a730bc37cdc0e1e
-
SSDEEP
196608:ejMmHhL8yKXmt4ITM0//StQo0BJoxPxF4DOkIvEb09PGuiGpyR38:ejMcKX2tQ0gQ5wx80xGu038
Score
3/10
Malware Config
Signatures
-
Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
27822be7809142a1c359312b6f5ab6a2.elfdescription ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size 27822be7809142a1c359312b6f5ab6a2.elf -
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/sys/net/core/somaxconn -
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes:
27822be7809142a1c359312b6f5ab6a2.elfdescription ioc Process File opened for modification /tmp/data/log/merlinServerLog.txt 27822be7809142a1c359312b6f5ab6a2.elf File opened for modification /tmp/readline.tmp