Analysis
-
max time kernel
156s -
max time network
160s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
-
submitted
19/12/2023, 22:27
General
-
Target
0a8f1993b067c6318dbbad322c9ffd1b
-
Size
98KB
-
MD5
0a8f1993b067c6318dbbad322c9ffd1b
-
SHA1
a8a714a44349a83aee39ad8780ba6a6e0ba65e69
-
SHA256
b7fa3b11a94e64e8733c4d577b6b8666ad9d95f7566be01e9a324cd6fdecf8a8
-
SHA512
0a63098b61ba022f42b78374d771311d3e0ec3a17b2b8440022a88ccd6e4397d8905425e4dd7abc44df68ebe0d11adf08c4c3a6019f05ea18039affd38775fcd
-
SSDEEP
3072:he7EqeQUHfPyjRJ9rBFKqY4F1QmqoVcqq6GnQOT:heZyo5KqY4PQmqoVcqq6GnQOT
Malware Config
Signatures
-
Contacts a large (23523) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/0a8f1993b067c6318dbbad322c9ffd1b/tmp/0a8f1993b067c6318dbbad322c9ffd1b1⤵
- Changes its process name
- Reads system routing table
- Reads system network configuration