Analysis
-
max time kernel
153s -
max time network
158s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
-
submitted
20/12/2023, 00:56
General
-
Target
76ada34bf673094ebd01adb2d59fcece
-
Size
134KB
-
MD5
76ada34bf673094ebd01adb2d59fcece
-
SHA1
0c13416fc57e2ac6e2fa113b4a67b6860ba575a9
-
SHA256
1cbab2020d4136bc2ba83f0db5dfe717f4a5cbf050e95e6b5de18ed00e69bf59
-
SHA512
68019ace5efcfcaae3c601efd04563c8141e950dc4942bdef01c12b223b154963b2a51acfd27cdf2f06494707ca9082e90c9334ecf4cbb317e1f71e53197b3fe
-
SSDEEP
3072:4ZQZY32coHADuezsYHVOncO880kkGJ0kwLto3mNoMVqF4fF2t6:1BczDlzs8Ocb88Q3mNoMVqF4fF2t6
Malware Config
Signatures
-
Contacts a large (46864) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/76ada34bf673094ebd01adb2d59fcece/tmp/76ada34bf673094ebd01adb2d59fcece1⤵
- Changes its process name
- Reads system routing table
- Reads system network configuration