Analysis
-
max time kernel
3s -
max time network
106s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20230831-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20230831-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
18-10-2023 07:55
Behavioral task
behavioral1
Sample
6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502.elf
Resource
ubuntu1804-amd64-20230831-en
General
-
Target
6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502.elf
-
Size
2.0MB
-
MD5
3f9a28e8c057e7ea7ccf15a4db81f362
-
SHA1
10d6d3c957facf06098771bf409b9593eea58c75
-
SHA256
6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502
-
SHA512
58a71aeac247d206f023ee29aff81026881e41d3fbd268f7513e3bcd951701a68502361dd717befa79a094eb9fc0caaa9f8770ba83f5c94a8acb9ae0986ee386
-
SSDEEP
49152:k5Wy/20shMXR8uUz9cBbLc/6LCM01iNFFB9wO:k5Wy//sO8uDq6
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
pid 606 -
Reads CPU attributes 1 TTPs 1 IoCs
Processes:
description ioc File opened for reading /sys/devices/system/cpu/online -
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes:
6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502.elfdescription ioc process File opened for modification /tmp/.DBFD055C-9CF2-4BB8-908E-6DA22321BF17 6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502.elf File opened for modification /tmp/main.log
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/tmp/.DBFD055C-9CF2-4BB8-908E-6DA22321BF17Filesize
4B
MD5bf25b4d299ce95f2080acc5d231378f4
SHA1cedfa4d596db7e5001a94d5705aa02813896003a
SHA2565cd16be4700a8dc9e5fa233d8c4a2667f318f21c15d9b8c64791d5d15e9539d0
SHA5123add29ccc16fa3db082d46bf8d4b782068a44405a0cfe07033be45d8932c22ded5d4616243d9510f0c3ea2d87980d3f23d3c778643357a59cfeafa9c2f82ccba
-
/tmp/main.logFilesize
3KB
MD561b24ddd77ef57516e7738e4998eb3dc
SHA1569532db22f84c3e9054e76a3271097bb82773c1
SHA256a31847afc45f56fabd921fe70bc8dd50e76ce845634696b8e3c34436304f6f10
SHA512f8229ed9c48dc5c9b08fef7fb90bb8264ba7610f588189747fe39f752e18993b1792c180f3ba208cd49f7d9e079eb72b22bab6ef620dac58bc1b375eab3ee5c6