Analysis
-
max time kernel
108s -
max time network
151s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231222-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231222-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
12/01/2024, 03:48
Static task
static1
Behavioral task
behavioral1
Sample
fef00a4beb5d5594dc1df7877e14e58b81f5e81c8f56eb099e06224c6d960589.elf
Resource
ubuntu1804-amd64-20231222-en
ubuntu-18.04-amd64
General
-
Target
fef00a4beb5d5594dc1df7877e14e58b81f5e81c8f56eb099e06224c6d960589.elf
-
Size
156KB
-
MD5
d662627e3d63a5b7f0b208e8f6f28b63
-
SHA1
6bae55744bb8ef88392c8949037f6c45d30dc9b2
-
SHA256
fef00a4beb5d5594dc1df7877e14e58b81f5e81c8f56eb099e06224c6d960589
-
SHA512
082b7fea0804551b1ade4f278adecbf665be13d966de4ec828e529656ba6dd14b25bb203040ece7b3ec0ec1c5bee297be9a46726c80d758aa4fec810a5a5e081
-
SSDEEP
3072:5eR8cHQCl8NR2UyM+7fsCZMPPAPnDbzkZ7dYdhOi9XVHTxTY6:5eR8cHQCl8LQVY0jFHTxTY6
Malware Config
Signatures
-
Contacts a large (89105) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself #1,% # 1588 fef00a4beb5d5594dc1df7877e14e58b81f5e81c8f56eb099e06224c6d960589.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/1091/cmdline File opened for reading /proc/1130/cmdline File opened for reading /proc/157/cmdline File opened for reading /proc/173/cmdline File opened for reading /proc/439/cmdline File opened for reading /proc/799/cmdline File opened for reading /proc/1126/cmdline File opened for reading /proc/1169/cmdline File opened for reading /proc/1599/cmdline File opened for reading /proc/2/cmdline File opened for reading /proc/17/cmdline File opened for reading /proc/175/cmdline File opened for reading /proc/522/cmdline File opened for reading /proc/1162/cmdline File opened for reading /proc/1592/cmdline File opened for reading /proc/10/cmdline File opened for reading /proc/456/cmdline File opened for reading /proc/521/cmdline File opened for reading /proc/1017/cmdline File opened for reading /proc/1113/cmdline File opened for reading /proc/27/cmdline File opened for reading /proc/156/cmdline File opened for reading /proc/167/cmdline File opened for reading /proc/481/cmdline File opened for reading /proc/1135/cmdline File opened for reading /proc/79/cmdline File opened for reading /proc/1114/cmdline File opened for reading /proc/1236/cmdline File opened for reading /proc/1593/cmdline File opened for reading /proc/78/cmdline File opened for reading /proc/159/cmdline File opened for reading /proc/172/cmdline File opened for reading /proc/944/cmdline File opened for reading /proc/29/cmdline File opened for reading /proc/558/cmdline File opened for reading /proc/633/cmdline File opened for reading /proc/1043/cmdline File opened for reading /proc/1296/cmdline File opened for reading /proc/13/cmdline File opened for reading /proc/36/cmdline File opened for reading /proc/161/cmdline File opened for reading /proc/446/cmdline File opened for reading /proc/444/cmdline File opened for reading /proc/1595/cmdline File opened for reading /proc/5/cmdline File opened for reading /proc/7/cmdline File opened for reading /proc/83/cmdline File opened for reading /proc/162/cmdline File opened for reading /proc/693/cmdline File opened for reading /proc/1040/cmdline File opened for reading /proc/1045/cmdline File opened for reading /proc/85/cmdline File opened for reading /proc/89/cmdline File opened for reading /proc/528/cmdline File opened for reading /proc/578/cmdline File opened for reading /proc/1023/cmdline File opened for reading /proc/1052/cmdline File opened for reading /proc/1255/cmdline File opened for reading /proc/1336/cmdline File opened for reading /proc/25/cmdline File opened for reading /proc/82/cmdline File opened for reading /proc/132/cmdline File opened for reading /proc/672/cmdline File opened for reading /proc/1591/cmdline