3ceca27983222930da2fe97dc30c3b674dbfd72b8905d29602c1444b9bea6f2f

Analysis

max time kernel
152s
max time network
153s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231221-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231221-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
12/02/2024, 02:17

Target

3ceca27983222930da2fe97dc30c3b674dbfd72b8905d29602c1444b9bea6f2f.elf
Size

61KB
MD5

bb5ee5a08c2d74aa55a76a52a0e2af68
SHA1

e0f35f0bbcc520afc6ec970afc55ae387c358107
SHA256

3ceca27983222930da2fe97dc30c3b674dbfd72b8905d29602c1444b9bea6f2f
SHA512

37df7d8cd0d455ffed2e77fdf14a055ff172a1a3da06728f464686fc1ff8045058ba746e87e6fbfc977b5186a6133bb0f3c93c5bafc9f7f40588a4ad1a950c94
SSDEEP

1536:Ji6BIgV5FHFC8uguvTjWVWYedCNt8wyywwT1Z6SY:Ji6205FHrMvTAW0j8byZRZ8

Score

9^/10

discovery

Contacts a large (76258) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/usr/bin/dbus-daemon	1530	3ceca27983222930da2fe97dc30c3b674dbfd72b8905d29602c1444b9bea6f2f.elf

Deletes itself 1 IoCs

pid	Process
1530	3ceca27983222930da2fe97dc30c3b674dbfd72b8905d29602c1444b9bea6f2f.elf

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact