d45aca9ee44e1e510e951033f7ac72c137fc90129a7d5cd383296b6bd1e3ddb5

Analysis

max time kernel
0s
max time network
131s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
06/03/2024, 19:28

Target

SecuriteInfo.com.Trojan.Linux.Sshscan.14321.32478.elf
Size

7.4MB
MD5

74271c6112292c2dc12112adddffa655
SHA1

3bc62756b41f8545b65cac3ba6f3112cfae4bf37
SHA256

d45aca9ee44e1e510e951033f7ac72c137fc90129a7d5cd383296b6bd1e3ddb5
SHA512

66cb2950d3ad95746d3627220dbe13ccefb5b889f562e2b889910f5383813270b97a4731e919b6ce722dd02df9252babbe5a5070d623b284ce948c97a3b324c3
SSDEEP

98304:Pyz+vvIerFhoMIyX000Nu3JoPgN/izM6rt4F7EcGHYrmIzv:Pyz+vQerFSMIyX0NNu3kM6Bo7

Score

3^/10

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	SecuriteInfo.com.Trojan.Linux.Sshscan.14321.32478.elf

/tmp/SecuriteInfo.com.Trojan.Linux.Sshscan.14321.32478.elf
/tmp/SecuriteInfo.com.Trojan.Linux.Sshscan.14321.32478.elf
1⤵
- Enumerates kernel/hardware configuration
PID:1571

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact