General
-
Target
d14683e7fbe633207009e616e85660619adb8a3f01e1e53e9574684f0c6bda3c.elf
-
Size
1.8MB
-
Sample
231227-sja72sfgan
-
MD5
572b3eb3c15f14baad807804b8d8a0fe
-
SHA1
ac58bb2e2639006161748ec2bd1874ad1c66424a
-
SHA256
d14683e7fbe633207009e616e85660619adb8a3f01e1e53e9574684f0c6bda3c
-
SHA512
7c37cdf86ed9b52d239bdd5dff53489f43076f641a3b520b2247d6d3b54b358365a2a805c9dd2128976509a452cc9a2baa88969c8e7e53b1484faccd86ee4167
-
SSDEEP
49152:hNvOb/yflCgOeFQGgZJGfWzFleCP+FkRW3:vWbKflCg3FCGfWzFl/23
Behavioral task
behavioral1
Sample
d14683e7fbe633207009e616e85660619adb8a3f01e1e53e9574684f0c6bda3c.elf
Resource
ubuntu1804-amd64-20231215-en
Malware Config
Targets
-
-
Target
d14683e7fbe633207009e616e85660619adb8a3f01e1e53e9574684f0c6bda3c.elf
-
Size
1.8MB
-
MD5
572b3eb3c15f14baad807804b8d8a0fe
-
SHA1
ac58bb2e2639006161748ec2bd1874ad1c66424a
-
SHA256
d14683e7fbe633207009e616e85660619adb8a3f01e1e53e9574684f0c6bda3c
-
SHA512
7c37cdf86ed9b52d239bdd5dff53489f43076f641a3b520b2247d6d3b54b358365a2a805c9dd2128976509a452cc9a2baa88969c8e7e53b1484faccd86ee4167
-
SSDEEP
49152:hNvOb/yflCgOeFQGgZJGfWzFleCP+FkRW3:vWbKflCg3FCGfWzFl/23
Score9/10-
Contacts a large (234480) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Changes its process name
-
Checks CPU configuration
Checks CPU information which indicate if the system is a virtual machine.
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes
-
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
-