Analysis
-
max time kernel
152s -
max time network
144s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20230712-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20230712-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
16-08-2023 12:01
Static task
static1
Behavioral task
behavioral1
Sample
most-x86_64.elf
Resource
ubuntu1804-amd64-20230712-en
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
most-x86_64.elf
-
Size
131KB
-
MD5
54be2aaee1e0341b12735ee51a02840e
-
SHA1
6767cfedcc109353971412160191edd1bf38ce31
-
SHA256
3a628e157229d24c7140243d3705c38d5981526931e159353055eedafafdebee
-
SHA512
08d202fb59b94ff6782c8736ea4ec038c9568e939bec18b1cdb619b5d33c054daa34de494ec3c6a68b22944e0cfca5615256a84c5c1235e17021f0e25e1a88b2
-
SSDEEP
3072:1ZaCnmT1GxRpbsulpN8NhdFnflJ8ctNnd:1ZaCmkHQFfD8s
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself 593 most-x86_64.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/303/cmdline File opened for reading /proc/6/cmdline File opened for reading /proc/15/cmdline File opened for reading /proc/600/cmdline File opened for reading /proc/599/cmdline File opened for reading /proc/700/cmdline File opened for reading /proc/716/cmdline File opened for reading /proc/83/cmdline File opened for reading /proc/84/cmdline File opened for reading /proc/348/cmdline File opened for reading /proc/364/cmdline File opened for reading /proc/639/cmdline File opened for reading /proc/641/cmdline File opened for reading /proc/712/cmdline File opened for reading /proc/115/cmdline File opened for reading /proc/162/cmdline File opened for reading /proc/158/cmdline File opened for reading /proc/605/cmdline File opened for reading /proc/615/cmdline File opened for reading /proc/633/cmdline File opened for reading /proc/635/cmdline File opened for reading /proc/660/cmdline File opened for reading /proc/5/cmdline File opened for reading /proc/17/cmdline File opened for reading /proc/694/cmdline File opened for reading /proc/663/cmdline File opened for reading /proc/617/cmdline File opened for reading /proc/627/cmdline File opened for reading /proc/590/cmdline File opened for reading /proc/608/cmdline File opened for reading /proc/618/cmdline File opened for reading /proc/646/cmdline File opened for reading /proc/692/cmdline File opened for reading /proc/25/cmdline File opened for reading /proc/371/cmdline File opened for reading /proc/603/cmdline File opened for reading /proc/652/cmdline File opened for reading /proc/709/cmdline File opened for reading /proc/717/cmdline File opened for reading /proc/26/cmdline File opened for reading /proc/304/cmdline File opened for reading /proc/167/cmdline File opened for reading /proc/611/cmdline File opened for reading /proc/612/cmdline File opened for reading /proc/650/cmdline File opened for reading /proc/658/cmdline File opened for reading /proc/674/cmdline File opened for reading /proc/29/cmdline File opened for reading /proc/80/cmdline File opened for reading /proc/613/cmdline File opened for reading /proc/620/cmdline File opened for reading /proc/681/cmdline File opened for reading /proc/704/cmdline File opened for reading /proc/159/cmdline File opened for reading /proc/589/cmdline File opened for reading /proc/85/cmdline File opened for reading /proc/161/cmdline File opened for reading /proc/601/cmdline File opened for reading /proc/656/cmdline File opened for reading /proc/672/cmdline File opened for reading /proc/678/cmdline File opened for reading /proc/34/cmdline File opened for reading /proc/78/cmdline File opened for reading /proc/684/cmdline