Analysis
-
max time kernel
152s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231222-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231222-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
26/01/2024, 06:37
Behavioral task
behavioral1
Sample
76a5d82581bae59589ce180e8b57b92b
Resource
ubuntu1804-amd64-20231222-en
ubuntu-18.04-amd64
General
-
Target
76a5d82581bae59589ce180e8b57b92b
-
Size
64KB
-
MD5
76a5d82581bae59589ce180e8b57b92b
-
SHA1
eaafe32c7d49350a810b8e58c7d09af8cfd8acd1
-
SHA256
45003da00855fde55ec9c2746541da014aa3b78b5502b949acca7cd590c73f6f
-
SHA512
c7a5e1efdc457f51f301eb9b192a193e1a2b0aa2b9682e4346727fccddc63759bbcdd9dbb5d80bc5394254c031c7c8bbf944d5962d161741e1e245bb56723906
-
SSDEEP
1536:IkF9170vwHbQXZ5+qXDEuXi9P0SW7V/DjObeFt6PuQ4ZA:z917iwHbQXZ5+qXA59cSWZ/XObeb6GZZ
Malware Config
Signatures
-
Contacts a large (20787) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/446/fd File opened for reading /proc/464/fd File opened for reading /proc/1009/fd File opened for reading /proc/1968/exe File opened for reading /proc/1772/exe File opened for reading /proc/484/fd File opened for reading /proc/512/fd File opened for reading /proc/529/fd File opened for reading /proc/1227/fd File opened for reading /proc/436/exe File opened for reading /proc/1652/exe File opened for reading /proc/431/fd File opened for reading /proc/488/fd File opened for reading /proc/1941/exe File opened for reading /proc/462/fd File opened for reading /proc/1369/fd File opened for reading /proc/574/fd File opened for reading /proc/1168/fd File opened for reading /proc/703/exe File opened for reading /proc/1143/exe File opened for reading /proc/1918/exe File opened for reading /proc/511/fd File opened for reading /proc/1294/fd File opened for reading /proc/1610/fd File opened for reading /proc/1148/exe File opened for reading /proc/999/fd File opened for reading /proc/1172/fd File opened for reading /proc/1751/exe File opened for reading /proc/1984/exe File opened for reading /proc/1209/fd File opened for reading /proc/464/exe File opened for reading /proc/480/exe File opened for reading /proc/1954/exe File opened for reading /proc/1958/exe File opened for reading /proc/1023/fd File opened for reading /proc/1118/fd File opened for reading /proc/1152/exe File opened for reading /proc/1673/exe File opened for reading /proc/1746/exe File opened for reading /proc/1908/exe File opened for reading /proc/481/fd File opened for reading /proc/1605/fd File opened for reading /proc/1062/exe File opened for reading /proc/1612/exe File opened for reading /proc/1876/exe File opened for reading /proc/1944/exe File opened for reading /proc/713/fd File opened for reading /proc/1142/fd File opened for reading /proc/699/exe File opened for reading /proc/1683/exe File opened for reading /proc/1961/exe File opened for reading /proc/1340/fd File opened for reading /proc/448/exe File opened for reading /proc/1664/exe File opened for reading /proc/1974/exe File opened for reading /proc/1437/fd File opened for reading /proc/1879/exe File opened for reading /proc/613/fd File opened for reading /proc/483/exe File opened for reading /proc/484/exe File opened for reading /proc/873/exe File opened for reading /proc/1666/exe File opened for reading /proc/1755/exe File opened for reading /proc/539/fd