Analysis
-
max time kernel
121s -
max time network
138s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20230831-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20230831-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
29-09-2023 19:56
Static task
static1
Behavioral task
behavioral1
Sample
lolx86.elf
Resource
ubuntu1804-amd64-20230831-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
-
Target
lolx86.elf
-
Size
73KB
-
MD5
2f3f0d34c628ab0fd557ce866bafd4d1
-
SHA1
50663dcfc920cc955ec0b43c82a3fc008fe7b08d
-
SHA256
d618c817e6a93193a499126156a1f7e888008dacdb247a769fd69ce4c0c87b67
-
SHA512
8d0de7e7059aab212db0abc90b78d8882d80fc985b84437aaa87c185bcbe0e2c927fbaaa93a445329c3719a5ddfa001814fb5f3bd78c24f6f3e289a52b4ad3d7
-
SSDEEP
1536:wOfmKQ5ZZFlqykbWg7YKFXBSKwhSmdqZwpKSP1wda:wqtQ5dlrW/BSKwhSmUEP2k
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself /sbin/init 612 -
Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 611 lolx86.elf -
Unexpected DNS network traffic destination 11 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 192.3.165.37 Destination IP 192.3.165.37 Destination IP 51.158.108.203 Destination IP 138.197.140.189 Destination IP 138.197.140.189 Destination IP 138.197.140.189 Destination IP 138.197.140.189 Destination IP 192.3.165.37 Destination IP 192.3.165.37 Destination IP 138.197.140.189 Destination IP 192.3.165.37 -
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/stat