Analysis
-
max time kernel
153s -
max time network
150s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
26/08/2023, 21:19
Static task
static1
Behavioral task
behavioral1
Sample
cundi.x86.elf
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
cundi.x86.elf
-
Size
81KB
-
MD5
0f3cafe5c364e949d2b290821c19f064
-
SHA1
ef447ffa0e77278a21c2f54d5b6422f9f37839d5
-
SHA256
81226130c99470d5ae4b0663477337100ef3c4ceb175fa078755543ee77e4dd4
-
SHA512
375b47a42c8aa6b41984be1f797be6c60f9df32a35e1bcfd4f15cf543a6c7887ea77ebd6d850c372c58cfa763163d54844db9b798d0f7a0f33b07ad18855112f
-
SSDEEP
1536:JuBj0SLUbDq71Oomq1TisuYLwwPnCgPmCRyTSQtUq:JuBIlbe785qZzuw/DPhU+e
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 575 cundi.x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/29/cmdline File opened for reading /proc/98/cmdline File opened for reading /proc/163/cmdline File opened for reading /proc/310/cmdline File opened for reading /proc/572/cmdline File opened for reading /proc/13/cmdline File opened for reading /proc/20/cmdline File opened for reading /proc/26/cmdline File opened for reading /proc/85/cmdline File opened for reading /proc/309/cmdline File opened for reading /proc/422/cmdline File opened for reading /proc/571/cmdline File opened for reading /proc/576/cmdline File opened for reading /proc/7/cmdline File opened for reading /proc/160/cmdline File opened for reading /proc/193/cmdline File opened for reading /proc/394/cmdline File opened for reading /proc/541/cmdline File opened for reading /proc/21/cmdline File opened for reading /proc/82/cmdline File opened for reading /proc/83/cmdline File opened for reading /proc/31/cmdline File opened for reading /proc/36/cmdline File opened for reading /proc/153/cmdline File opened for reading /proc/157/cmdline File opened for reading /proc/159/cmdline File opened for reading /proc/166/cmdline File opened for reading /proc/192/cmdline File opened for reading /proc/251/cmdline File opened for reading /proc/564/cmdline File opened for reading /proc/2/cmdline File opened for reading /proc/3/cmdline File opened for reading /proc/4/cmdline File opened for reading /proc/578/cmdline File opened for reading /proc/24/cmdline File opened for reading /proc/34/cmdline File opened for reading /proc/155/cmdline File opened for reading /proc/168/cmdline File opened for reading /proc/347/cmdline File opened for reading /proc/22/cmdline File opened for reading /proc/78/cmdline File opened for reading /proc/161/cmdline File opened for reading /proc/12/cmdline File opened for reading /proc/23/cmdline File opened for reading /proc/89/cmdline File opened for reading /proc/115/cmdline File opened for reading /proc/127/cmdline File opened for reading /proc/156/cmdline File opened for reading /proc/169/cmdline File opened for reading /proc/570/cmdline File opened for reading /proc/15/cmdline File opened for reading /proc/30/cmdline File opened for reading /proc/80/cmdline File opened for reading /proc/162/cmdline File opened for reading /proc/252/cmdline File opened for reading /proc/350/cmdline File opened for reading /proc/391/cmdline File opened for reading /proc/573/cmdline File opened for reading /proc/9/cmdline File opened for reading /proc/25/cmdline File opened for reading /proc/84/cmdline File opened for reading /proc/333/cmdline File opened for reading /proc/35/cmdline File opened for reading /proc/154/cmdline