48a70bd18a23fce3208195f4ad2e92fce78d37eeaa672f83af782656a4b2d07f

Analysis

max time kernel
93s
max time network
122s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20230621-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20230621-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
04/08/2023, 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27822be7809142a1c359312b6f5ab6a2.elf
Size

16.9MB
MD5

27822be7809142a1c359312b6f5ab6a2
SHA1

81af90eed795025c48bca6c8b0b278361f0d977b
SHA256

48a70bd18a23fce3208195f4ad2e92fce78d37eeaa672f83af782656a4b2d07f
SHA512

09952a96d35787bf356e7ee93fad46f47e1726c0a3f6c7a0ed5cd084085935feeac422c9a1d236965ec3cdc73125f9d3dca9d7e8a0dd05be5a730bc37cdc0e1e
SSDEEP

196608:ejMmHhL8yKXmt4ITM0//StQo0BJoxPxF4DOkIvEb09PGuiGpyR38:ejMcKX2tQ0gQ5wx80xGu038

Score

3^/10

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	27822be7809142a1c359312b6f5ab6a2.elf

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/sys/net/core/somaxconn

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/data/log/merlinServerLog.txt	27822be7809142a1c359312b6f5ab6a2.elf
File opened for modification	/tmp/readline.tmp	Process not Found

/tmp/27822be7809142a1c359312b6f5ab6a2.elf
/tmp/27822be7809142a1c359312b6f5ab6a2.elf
1⤵
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:599

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/data/log/merlinServerLog.txt

Filesize
77B

MD5
fffa9494dad79ac974d0ac78e18b0936

SHA1
c45f5c2a173f22a5c2af859ecff8bb653f121f22

SHA256
405321f00f0f5a889be25757d66f0b6ee4ecb1212bf05ee2e08f9e4250e1684e

SHA512
4a6c26e362142c54412dc86eebac5dd3a6c8ae9793befe0a850340c6b64b815bc113c12c47dabd79417d9d9a3bb5bca715f2907b477494c827bd86ac7ed81d5e

Download Submit