Analysis
-
max time kernel
151s -
max time network
154s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20230831-en -
resource tags
-
submitted
06-10-2023 16:04
General
-
Target
NEAS.d9d783f550e8627c50a10eca332856d5e807b5f96c6e9fae75d4095c4c5ec110elf_JC.elf
-
Size
112KB
-
MD5
c50077086bc9d977d043e3894ed9af1c
-
SHA1
9337e5760a543123584b0509b898c36bd5fadd88
-
SHA256
d9d783f550e8627c50a10eca332856d5e807b5f96c6e9fae75d4095c4c5ec110
-
SHA512
7e79710e7b4fd277e7cf357e3224d68377c95db6bea92d2c2cdc4e696f0f715ae40bfa1eea76838cd2190f44b7d5356ca4225faa05df089f79cf0e9c4af1602b
-
SSDEEP
3072:DNCnGZBiSCRTU2jTXVRQxOshGu9lRTNtAF05FI6RkFMF0:DkGZBiSUTnTXzMhh3RTNt2qF0
Malware Config
Signatures
-
Contacts a large (37001) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Deletes itself 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/NEAS.d9d783f550e8627c50a10eca332856d5e807b5f96c6e9fae75d4095c4c5ec110elf_JC.elf/tmp/NEAS.d9d783f550e8627c50a10eca332856d5e807b5f96c6e9fae75d4095c4c5ec110elf_JC.elf1⤵
- Changes its process name
- Deletes itself
- Writes file to tmp directory