Overview

overview

9

Static

static

1

adefd6b37e...54.elf

ubuntu-20.04-amd64

9

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240221-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    09/04/2024, 01:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    adefd6b37ee3dc189916368a6070f1e6cc1480b4564c8ffcbc23d714cfeabc54.elf

  • Size

    109KB

  • MD5

    8cc0cdf62fc99a47b520924c39b869ab

  • SHA1

    f822213efb7a389ccff9e24d5120eb9555693c54

  • SHA256

    adefd6b37ee3dc189916368a6070f1e6cc1480b4564c8ffcbc23d714cfeabc54

  • SHA512

    dcbd8fbf8274308555b1806ca496490c9b05d43069e1ae0f0c2ba0a6cb2d9ab2c83f49d6fc5dcc2cb5ca4118fc2b3678613ffd9513a34a3ba8b359575fe3c8f5

  • SSDEEP

    1536:MDT1HnGuT9ZplJsQd6T1kRezWxNTnMGAZPHIFbsSPrg7x83zR:MDMC9Zj5i1aPxhnMNZfIJg63zR

Score
9/10
discovery

Malware Config

Signatures

  • Contacts a large (38144) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Changes its process name 1 IoCs
  • Deletes itself 1 IoCs
  • Traces itself 1 IoCs

    Traces itself to prevent debugging attempts

  • Unexpected DNS network traffic destination 6 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/adefd6b37ee3dc189916368a6070f1e6cc1480b4564c8ffcbc23d714cfeabc54.elf
    /tmp/adefd6b37ee3dc189916368a6070f1e6cc1480b4564c8ffcbc23d714cfeabc54.elf
    1⤵
    • Changes its process name
    • Deletes itself
    • Traces itself
    PID:1489

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads