Analysis
-
max time kernel
152s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231222-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231222-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
12-02-2024 04:23
Behavioral task
behavioral1
Sample
6a75a895731f82107fce9ab4ea68b48393cfc023541e416b99069f22c326cbe0.elf
Resource
ubuntu1804-amd64-20231222-en
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
6a75a895731f82107fce9ab4ea68b48393cfc023541e416b99069f22c326cbe0.elf
-
Size
66KB
-
MD5
febc3c5e8a66df3dceb228a75b0af7cd
-
SHA1
1be01008f1e782124870e38a6a9d301b23c756e5
-
SHA256
6a75a895731f82107fce9ab4ea68b48393cfc023541e416b99069f22c326cbe0
-
SHA512
51308676d4edda06c81725374d08386b7e1c41b01e6a2ce832de091e469bf59a6091f2450b4a39e13564febb8afdca19629d359f0e81ac62c64dcf0a2fd017b1
-
SSDEEP
1536:oFCLfIlpZ2TFPjS31resR2ukW/6xyT49mFvqKPCe:oFCLAlpcTFPjQ1rcKixyTOIvTPZ
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/bin/dbus-daemon 1596 6a75a895731f82107fce9ab4ea68b48393cfc023541e416b99069f22c326cbe0.elf -
Deletes itself 1 IoCs
pid Process 1596 6a75a895731f82107fce9ab4ea68b48393cfc023541e416b99069f22c326cbe0.elf -
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/1577/fd