Analysis
-
max time kernel
155s -
max time network
159s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
19/12/2023, 22:22
Behavioral task
behavioral1
Sample
0308738cff29f91bc4e9e2831a6605ae
Resource
ubuntu1804-amd64-20231215-en
General
-
Target
0308738cff29f91bc4e9e2831a6605ae
-
Size
119KB
-
MD5
0308738cff29f91bc4e9e2831a6605ae
-
SHA1
8ed0187dcc41d92059afe88cecf2d9e917f24775
-
SHA256
5fd664085bb2e927c6d93007083710eaad24786b849d8be382f8e0d059956940
-
SHA512
3e334b66141989cf4a40a27ced6f0fe0e8cc732bcf4fca2a31fc4317853c364022ea2c4db19d20728892d3c12a6f300c14116b48cff6841810febdb0425cbdff
-
SSDEEP
3072:y15qz+kA1g7Rwtfn6/YOsniwDLvzBdtmNl1VhbaRklkNb:y1l1TR6/Yzi8jtmNl1VhbaRklkNb
Malware Config
Signatures
-
Contacts a large (23366) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself sshd 1612 0308738cff29f91bc4e9e2831a6605ae -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route 0308738cff29f91bc4e9e2831a6605ae -
Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route 0308738cff29f91bc4e9e2831a6605ae File opened for reading /proc/net/tcp Process not Found -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/442/maps File opened for reading /proc/1110/maps File opened for reading /proc/1358/maps File opened for reading /proc/1066/maps File opened for reading /proc/1087/maps File opened for reading /proc/1266/maps File opened for reading /proc/1617/maps File opened for reading /proc/1618/maps File opened for reading /proc/465/maps File opened for reading /proc/677/maps File opened for reading /proc/739/maps File opened for reading /proc/1191/maps File opened for reading /proc/1615/maps File opened for reading /proc/449/maps File opened for reading /proc/598/maps File opened for reading /proc/1207/maps File opened for reading /proc/1217/maps File opened for reading /proc/1221/maps File opened for reading /proc/448/maps File opened for reading /proc/1388/maps File opened for reading /proc/430/maps File opened for reading /proc/1190/maps File opened for reading /proc/533/maps File opened for reading /proc/1128/maps File opened for reading /proc/1592/maps File opened for reading /proc/1218/maps File opened for reading /proc/1317/maps File opened for reading /proc/1385/maps File opened for reading /proc/1464/maps File opened for reading /proc/1216/maps File opened for reading /proc/1184/maps File opened for reading /proc/1574/maps File opened for reading /proc/466/maps File opened for reading /proc/657/maps File opened for reading /proc/1298/maps File opened for reading /proc/622/maps File opened for reading /proc/531/maps File opened for reading /proc/1144/maps File opened for reading /proc/1152/maps File opened for reading /proc/1177/maps File opened for reading /proc/1182/maps File opened for reading /proc/1284/maps File opened for reading /proc/1367/maps File opened for reading /proc/461/maps File opened for reading /proc/475/maps File opened for reading /proc/1072/maps File opened for reading /proc/1115/maps File opened for reading /proc/1407/maps File opened for reading /proc/698/maps File opened for reading /proc/993/maps File opened for reading /proc/1142/maps File opened for reading /proc/1160/maps File opened for reading /proc/462/maps File opened for reading /proc/621/maps File opened for reading /proc/1037/maps File opened for reading /proc/1085/maps File opened for reading /proc/1164/maps File opened for reading /proc/966/maps File opened for reading /proc/1181/maps File opened for reading /proc/1331/maps File opened for reading /proc/1178/maps File opened for reading /proc/1210/maps File opened for reading /proc/1347/maps File opened for reading /proc/428/maps