eead8beb53d42b8870d687cd697468c61dc26650e48870483292319b6b43ecde

Analysis

max time kernel
152s
max time network
153s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20230831-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20230831-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
10-10-2023 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b840b89f921d1da241ee67885317188163f68c3c41e1f48c34796f89a96b07a.elf
Size

66KB
MD5

25148a67d4a633d2ecb4e4b88017e0c6
SHA1

be09ab65625a1f2fd48969773b77d99c9c61ca6f
SHA256

9b840b89f921d1da241ee67885317188163f68c3c41e1f48c34796f89a96b07a
SHA512

1b7b65676a69c5b6982414c673b403dec688b5a7bea1a31c5192d7f5332ddd8d713b838dac1888d5ceb5a3fe37ca3378cc6a5acfea844d9da72a7d43f15951ce
SSDEEP

1536:T/u7iGGEUDUmclqukZVyeKDkGM1bPXim1UzvpgxU1O:at1UDUXlqVVUkGMB7qzvUU1

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (23513) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a	604	9b840b89f921d1da241ee67885317188163f68c3c41e1f48c34796f89a96b07a.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

Reads runtime system information 14 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/608/maps
File opened for reading	/proc/609/maps
File opened for reading	/proc/458/maps
File opened for reading	/proc/602/maps
File opened for reading	/proc/575/maps
File opened for reading	/proc/600/maps
File opened for reading	/proc/606/maps
File opened for reading	/proc/435/maps
File opened for reading	/proc/436/maps
File opened for reading	/proc/472/maps
File opened for reading	/proc/601/maps
File opened for reading	/proc/610/maps
File opened for reading	/proc/425/maps
File opened for reading	/proc/599/maps

/tmp/9b840b89f921d1da241ee67885317188163f68c3c41e1f48c34796f89a96b07a.elf
/tmp/9b840b89f921d1da241ee67885317188163f68c3c41e1f48c34796f89a96b07a.elf
1⤵
- Changes its process name
PID:604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads