Overview

overview

8

Static

static

1

5fa7595c38...pkey_5

ubuntu-20.04-amd64

8

Resubmissions

02/05/2024, 13:21

240502-qll18ahg3s7

09/04/2024, 12:32

240409-pql2caac4v8

09/04/2024, 11:57

240409-n41afsed377

08/04/2024, 11:38

240408-nr43wagb767

02/04/2024, 11:55

240402-n3f57ahb3s7

27/03/2024, 13:16

240327-qhx93sga5v7

25/03/2024, 07:32

240325-jczgmade817

13/03/2024, 10:09

240313-l6zetsag217

Sharing

Copy URL Twitter E-mail

General

  • Target
    5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
  • Size 8.1MB
  • Sample240409-pql2caac4v
  • SHA256 471c70b6764c6f719bab35b92678e323d53928a14617737a6fc994dc27d2a12e
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
antivmdiscoveryinfostealerlinux

Malware Config

Targets

    • Target
      5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
    • Size 8.1MB
    • SHA256 471c70b6764c6f719bab35b92678e323d53928a14617737a6fc994dc27d2a12e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    antivmdiscoveryinfostealer

    • Contacts a large (1091) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Deletes itself

    • Reads EFI boot settings

      Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

      infostealer

    • Attempts to change immutable files

      Modifies inode attributes on the filesystem to allow changing of immutable files.

    • Checks CPU configuration

      Checks CPU information which indicate if the system is a virtual machine.

      antivm

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads CPU attributes

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks