Overview

overview

9

Static

static

1

NEAS.d9d78...JC.elf

ubuntu-18.04-amd64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.d9d783f550e8627c50a10eca332856d5e807b5f96c6e9fae75d4095c4c5ec110elf_JC.elf

  • Size

    112KB

  • Sample

    231006-th496sec2y

  • MD5

    c50077086bc9d977d043e3894ed9af1c

  • SHA1

    9337e5760a543123584b0509b898c36bd5fadd88

  • SHA256

    d9d783f550e8627c50a10eca332856d5e807b5f96c6e9fae75d4095c4c5ec110

  • SHA512

    7e79710e7b4fd277e7cf357e3224d68377c95db6bea92d2c2cdc4e696f0f715ae40bfa1eea76838cd2190f44b7d5356ca4225faa05df089f79cf0e9c4af1602b

  • SSDEEP

    3072:DNCnGZBiSCRTU2jTXVRQxOshGu9lRTNtAF05FI6RkFMF0:DkGZBiSUTnTXzMhh3RTNt2qF0

Score
9/10
antivmdiscoverylinux

Malware Config

Targets

    • Target

      NEAS.d9d783f550e8627c50a10eca332856d5e807b5f96c6e9fae75d4095c4c5ec110elf_JC.elf

    • Size

      112KB

    • MD5

      c50077086bc9d977d043e3894ed9af1c

    • SHA1

      9337e5760a543123584b0509b898c36bd5fadd88

    • SHA256

      d9d783f550e8627c50a10eca332856d5e807b5f96c6e9fae75d4095c4c5ec110

    • SHA512

      7e79710e7b4fd277e7cf357e3224d68377c95db6bea92d2c2cdc4e696f0f715ae40bfa1eea76838cd2190f44b7d5356ca4225faa05df089f79cf0e9c4af1602b

    • SSDEEP

      3072:DNCnGZBiSCRTU2jTXVRQxOshGu9lRTNtAF05FI6RkFMF0:DkGZBiSUTnTXzMhh3RTNt2qF0

    Score
    9/10
    antivmdiscovery

    • Contacts a large (37001) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Changes its process name

    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Checks CPU configuration

      Checks CPU information which indicate if the system is a virtual machine.

      antivm
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks