Analysis
- max time kernel
5s - max time network
133s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20231215-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
04/02/2024, 04:32
Static task
static1
Behavioral task
behavioral1
Sample
gEsD2heW4crIT.elf
Resource
ubuntu1804-amd64-20231215-en
4 signatures
150 seconds
General
- Target gEsD2heW4crIT.elf
- Size 858KB
- Sample240204-e5ynkscacn
- SHA256 030eb56e155fb01d7b190866aaa8b3128f935afd0b7a7b2178dc8e2eb84228b0
- MD5 deff93081ccb3fda7a12f6e9e3ad15ad
- SHA1 40b88819594091111c93bd9578b82dedd0823362
- SHA512 06283a51aa7eaaa4e2959a70f324909cc1f2870f2792bfd5f935624e6ce42a740edd1daf4af15c61380f724ca9f4b3b9f61355a7d63d01506f70883436710265
- SSDEEP 24576:aR4f424TMgHBwOmA8vzHhyKDnPAzRDLZUaWX:aR4xzgHVmAIHhnDnIR+aWX
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Changes its process name 1 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself tokio-runtime-w 1548 - Deletes itself 1 IoCs
pid Process 1547 gEsD2heW4crIT.elf - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us gEsD2heW4crIT.elf - Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/self/cgroup gEsD2heW4crIT.elf File opened for reading /proc/self/mountinfo gEsD2heW4crIT.elf