Resubmissions

27-12-2023 15:08

231227-sja72sfgan 9

27-12-2023 15:08

231227-sh5p9sffhl 9

12-12-2023 14:05

231212-rdvh3aeahp 9

General

  • Target

    d14683e7fbe633207009e616e85660619adb8a3f01e1e53e9574684f0c6bda3c.elf

  • Size

    1.8MB

  • Sample

    231227-sja72sfgan

  • MD5

    572b3eb3c15f14baad807804b8d8a0fe

  • SHA1

    ac58bb2e2639006161748ec2bd1874ad1c66424a

  • SHA256

    d14683e7fbe633207009e616e85660619adb8a3f01e1e53e9574684f0c6bda3c

  • SHA512

    7c37cdf86ed9b52d239bdd5dff53489f43076f641a3b520b2247d6d3b54b358365a2a805c9dd2128976509a452cc9a2baa88969c8e7e53b1484faccd86ee4167

  • SSDEEP

    49152:hNvOb/yflCgOeFQGgZJGfWzFleCP+FkRW3:vWbKflCg3FCGfWzFl/23

Malware Config

Targets

    • Target

      d14683e7fbe633207009e616e85660619adb8a3f01e1e53e9574684f0c6bda3c.elf

    • Size

      1.8MB

    • MD5

      572b3eb3c15f14baad807804b8d8a0fe

    • SHA1

      ac58bb2e2639006161748ec2bd1874ad1c66424a

    • SHA256

      d14683e7fbe633207009e616e85660619adb8a3f01e1e53e9574684f0c6bda3c

    • SHA512

      7c37cdf86ed9b52d239bdd5dff53489f43076f641a3b520b2247d6d3b54b358365a2a805c9dd2128976509a452cc9a2baa88969c8e7e53b1484faccd86ee4167

    • SSDEEP

      49152:hNvOb/yflCgOeFQGgZJGfWzFleCP+FkRW3:vWbKflCg3FCGfWzFl/23

    • Contacts a large (234480) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Changes its process name

    • Checks CPU configuration

      Checks CPU information which indicate if the system is a virtual machine.

    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads CPU attributes

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

MITRE ATT&CK Enterprise v15

Tasks