Analysis
-
max time kernel
155s -
max time network
158s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
14/01/2024, 14:45
Behavioral task
behavioral1
Sample
skyljne.x86.elf
Resource
ubuntu1804-amd64-20231215-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
-
Target
skyljne.x86.elf
-
Size
100KB
-
MD5
2357668b7c737cf603987f04c89b61b2
-
SHA1
53cba284d060b97b7db31be433d238fd715f72a3
-
SHA256
b0afcbfd840a393d2e7f4d630986ebc74cdce549aac0cca687e35296cec62ee3
-
SHA512
3fb4970452b3572439f5dd3b7b5a5701ace7547b3c8a6435015de49cf1dab02ce9f9d82f6e90da69d34597f7780dfc385d330615419bdb6512566de7b0db017a
-
SSDEEP
3072:0S1GIt7wDRKt2+YrhVJtcbbO/njYoYMV:0oBcDRjk2nrrV
Score
9/10
Malware Config
Signatures
-
Contacts a large (128447) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1549 skyljne.x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/178/cmdline File opened for reading /proc/547/cmdline File opened for reading /proc/5/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/26/cmdline File opened for reading /proc/27/cmdline File opened for reading /proc/31/cmdline File opened for reading /proc/177/cmdline File opened for reading /proc/1163/cmdline File opened for reading /proc/11/cmdline File opened for reading /proc/83/cmdline File opened for reading /proc/484/cmdline File opened for reading /proc/1121/cmdline File opened for reading /proc/656/cmdline File opened for reading /proc/665/cmdline File opened for reading /proc/6/cmdline File opened for reading /proc/16/cmdline File opened for reading /proc/17/cmdline File opened for reading /proc/20/cmdline File opened for reading /proc/82/cmdline File opened for reading /proc/168/cmdline File opened for reading /proc/971/cmdline File opened for reading /proc/1053/cmdline File opened for reading /proc/1145/cmdline File opened for reading /proc/22/cmdline File opened for reading /proc/208/cmdline File opened for reading /proc/429/cmdline File opened for reading /proc/730/cmdline File opened for reading /proc/1137/cmdline File opened for reading /proc/1204/cmdline File opened for reading /proc/1/cmdline File opened for reading /proc/4/cmdline File opened for reading /proc/34/cmdline File opened for reading /proc/970/cmdline File opened for reading /proc/1128/cmdline File opened for reading /proc/1174/cmdline File opened for reading /proc/15/cmdline File opened for reading /proc/458/cmdline File opened for reading /proc/1028/cmdline File opened for reading /proc/1189/cmdline File opened for reading /proc/1191/cmdline File opened for reading /proc/1305/cmdline File opened for reading /proc/12/cmdline File opened for reading /proc/171/cmdline File opened for reading /proc/1251/cmdline File opened for reading /proc/167/cmdline File opened for reading /proc/537/cmdline File opened for reading /proc/1175/cmdline File opened for reading /proc/32/cmdline File opened for reading /proc/453/cmdline File opened for reading /proc/607/cmdline File opened for reading /proc/647/cmdline File opened for reading /proc/721/cmdline File opened for reading /proc/1557/cmdline File opened for reading /proc/28/cmdline File opened for reading /proc/609/cmdline File opened for reading /proc/1162/cmdline File opened for reading /proc/1553/cmdline File opened for reading /proc/84/cmdline File opened for reading /proc/130/cmdline File opened for reading /proc/554/cmdline File opened for reading /proc/1047/cmdline File opened for reading /proc/1252/cmdline File opened for reading /proc/1550/cmdline