Analysis
-
max time kernel
152s -
max time network
149s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231222-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231222-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
18/02/2024, 05:41
General
-
Target
2c5ec634b6895ad6df4d8d38e082d690599788c4d805593601a96d97be0a51f9.elf
-
Size
31KB
-
MD5
500b884d421ee1d24c962f9abb46a70e
-
SHA1
e2f3eea8c30ec6b79370c12dd0ed0b2f0b3ef427
-
SHA256
2c5ec634b6895ad6df4d8d38e082d690599788c4d805593601a96d97be0a51f9
-
SHA512
6f55ab8ec942012caa51869243b2370e33a6d2c2f3bb46581ef21b28da992e9300a6aabcd7d20f60a1a96dfccb76de324e1d48f550045502d943e5b2666273d0
-
SSDEEP
768:BGvb+A02V/4ft3w48NhJ/dwjysJaC+mT/uKQ1:Bq74fJ2/dwZFm51
Malware Config
Extracted
Family
mirai
Botnet
MIRAI
C2
client.orxy.space
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a 1608 2c5ec634b6895ad6df4d8d38e082d690599788c4d805593601a96d97be0a51f9.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/24/maps Process not Found File opened for reading /proc/483/maps Process not Found File opened for reading /proc/1003/maps Process not Found File opened for reading /proc/427/cmdline Process not Found File opened for reading /proc/1594/cmdline Process not Found File opened for reading /proc/1172/maps Process not Found File opened for reading /proc/14/cmdline Process not Found File opened for reading /proc/30/cmdline Process not Found File opened for reading /proc/5/maps Process not Found File opened for reading /proc/554/maps Process not Found File opened for reading /proc/1096/maps Process not Found File opened for reading /proc/1104/maps Process not Found File opened for reading /proc/1128/maps Process not Found File opened for reading /proc/458/cmdline Process not Found File opened for reading /proc/1072/cmdline Process not Found File opened for reading /proc/1006/maps Process not Found File opened for reading /proc/118/cmdline Process not Found File opened for reading /proc/1020/cmdline Process not Found File opened for reading /proc/self/exe 2c5ec634b6895ad6df4d8d38e082d690599788c4d805593601a96d97be0a51f9.elf File opened for reading /proc/166/maps Process not Found File opened for reading /proc/202/maps Process not Found File opened for reading /proc/475/maps Process not Found File opened for reading /proc/706/maps Process not Found File opened for reading /proc/1149/cmdline Process not Found File opened for reading /proc/1317/cmdline Process not Found File opened for reading /proc/2/maps Process not Found File opened for reading /proc/444/maps Process not Found File opened for reading /proc/449/maps Process not Found File opened for reading /proc/1440/cmdline Process not Found File opened for reading /proc/560/cmdline Process not Found File opened for reading /proc/1136/cmdline Process not Found File opened for reading /proc/1063/maps Process not Found File opened for reading /proc/1082/maps Process not Found File opened for reading /proc/20/cmdline Process not Found File opened for reading /proc/26/cmdline Process not Found File opened for reading /proc/78/cmdline Process not Found File opened for reading /proc/1291/cmdline Process not Found File opened for reading /proc/1609/cmdline Process not Found File opened for reading /proc/450/maps Process not Found File opened for reading /proc/1087/maps Process not Found File opened for reading /proc/22/cmdline Process not Found File opened for reading /proc/1082/cmdline Process not Found File opened for reading /proc/1239/cmdline Process not Found File opened for reading /proc/27/maps Process not Found File opened for reading /proc/162/maps Process not Found File opened for reading /proc/1123/cmdline Process not Found File opened for reading /proc/1150/cmdline Process not Found File opened for reading /proc/19/maps Process not Found File opened for reading /proc/82/maps Process not Found File opened for reading /proc/1271/maps Process not Found File opened for reading /proc/15/cmdline Process not Found File opened for reading /proc/1096/cmdline Process not Found File opened for reading /proc/503/cmdline Process not Found File opened for reading /proc/118/maps Process not Found File opened for reading /proc/164/maps Process not Found File opened for reading /proc/158/cmdline Process not Found File opened for reading /proc/161/cmdline Process not Found File opened for reading /proc/451/cmdline Process not Found File opened for reading /proc/1153/cmdline Process not Found File opened for reading /proc/35/maps Process not Found File opened for reading /proc/1132/maps Process not Found File opened for reading /proc/1165/maps Process not Found File opened for reading /proc/1186/maps Process not Found File opened for reading /proc/23/cmdline Process not Found