Analysis
-
max time kernel
153s -
max time network
156s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
-
submitted
20/12/2023, 00:10
General
-
Target
720bba8499e21988019211d4b265f9f6
-
Size
98KB
-
MD5
720bba8499e21988019211d4b265f9f6
-
SHA1
2c3024a3b381bc76ac05591eb6bafd97413d0371
-
SHA256
261202a403c9177eaf58331dc0c386158b24fa1f5365e13de4ab374b10efdb8b
-
SHA512
4207be23913c27ea4a76e73470e5567f415089d356c137692f9820f665b92b3506ab550886bfe9ded0d23835ec930ba133f1c795338ae1f5dc168ccc695d6b33
-
SSDEEP
3072:he7EqekUHfPyjRJ9rBFKqk2F1QmqoVcqq6GnQOT:heZyo5Kqk2PQmqoVcqq6GnQOT
Malware Config
Signatures
-
Contacts a large (23684) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/720bba8499e21988019211d4b265f9f6/tmp/720bba8499e21988019211d4b265f9f61⤵
- Changes its process name
- Reads system routing table
- Reads system network configuration