Overview

overview

10

Static

static

10

31dd438c32...44.elf

ubuntu-18.04-amd64

9

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240226-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    15/03/2024, 13:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    31dd438c323b07e86776ba7c69fb8444.elf

  • Size

    37KB

  • MD5

    31dd438c323b07e86776ba7c69fb8444

  • SHA1

    94bc81ca8b54fe8c26fcf5de553eac160352e3c8

  • SHA256

    0e9029207f1f762275fa9d5bf88a547004ebbe8b430bc0fda325f8f7a88920c7

  • SHA512

    e15d5697358691471213b83b976c2bd919a05060cfcabfe3f29a21b0df02eccbf941c149fb33ae9d3c70c733acec1d0a2210033cbdf7a205d22e753840be0cd2

  • SSDEEP

    768:6ryDw+2jd+xIPTWri8wklJugN7V3NwXVAaceiV5og:7w+2j02PirrigN7jwXVxceivog

Score
9/10
discovery

Malware Config

Signatures

  • Contacts a large (76260) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Changes its process name 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/31dd438c323b07e86776ba7c69fb8444.elf
    /tmp/31dd438c323b07e86776ba7c69fb8444.elf
    1⤵
    • Changes its process name
    • Modifies Watchdog functionality
    PID:1515

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads