b89e29063ba0dbe95a2090399595668817473361c96ef622d143ec7980cddb1b

Analysis

max time kernel
150s
max time network
154s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
17-04-2024 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf
Size

74KB
MD5

20d263bd6e0552cad17ec45eeff1844b
SHA1

67a23901d5f3276ba4e8c95c21aeb79ca584a36a
SHA256

648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b
SHA512

f721ddcbcb19d22057d8a4b7402fa8d852872b3df3de18a13b8c983407fb29cd06ef7b9c35c4c50a179ac98fd2e70296806487fc59d4a9e291fa248662ac5eef
SSDEEP

1536:EUPldq0TJFnqXKvdo7DYZXjs56tbWuhyN/XemIdRI1R+5vY1SLq7wTVVi:9NdDznqoK7D4s5UWxem0I1R+JeSOcTf

Score

7^/10

evasion

Malware Config

Signatures

Changes its process name 1 IoCs

Processes:

648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	mlf4pvwv560dntpv	1471	648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf

Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
evasion

Indicator Removal
T1070

Processes:

description ioc

File deleted /var/log/audit/audit.log
Deletes itself 1 IoCs

Processes:

648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf

pid process

1471 648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf
Deletes journal logs 1 TTPs 1 IoCs
Deletes systemd journal logs. Likely to evade detection.
evasion

Indicator Removal
T1070

Processes:

description ioc

File deleted /var/log/journal/4816dd152e8c48ff97e9117d197c13d8/system.journal
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
evasion

Indicator Removal
T1070

Processes:

description ioc

File deleted /var/log/syslog

description	ioc
File deleted	/var/log/audit/audit.log

pid	process
1471	648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf

description	ioc
File deleted	/var/log/journal/4816dd152e8c48ff97e9117d197c13d8/system.journal

description	ioc
File deleted	/var/log/syslog

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf

description	ioc	process
File opened for modification	/dev/misc/watchdog	648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf
File opened for modification	/dev/watchdog	648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf

Deletes log files 1 TTPs 4 IoCs
Deletes log files on the system.

Indicator Removal
T1070

Processes:

description ioc

File deleted /var/log/auth.log
File deleted /var/log/ubuntu-advantage.log
File deleted /var/log/kern.log
File deleted /var/log/apport.log
Enumerates running processes
Discovers information about currently running processes on the system

description	ioc
File deleted	/var/log/auth.log
File deleted	/var/log/ubuntu-advantage.log
File deleted	/var/log/kern.log
File deleted	/var/log/apport.log

Reads CPU attributes 1 TTPs 10 IoCs

System Information Discovery

T1082

Processes:

pkillpkillpkillpkillpkillpkillpkillpkillpkillpkill

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pkillpkillpkillpkillpkillpkillpkillpkillpkillpkill

description	ioc	process
File opened for reading	/proc/394/status	pkill
File opened for reading	/proc/494/cmdline	pkill
File opened for reading	/proc/81/cmdline
File opened for reading	/proc/84/status	pkill
File opened for reading	/proc/201/cmdline	pkill
File opened for reading	/proc/70/status	pkill
File opened for reading	/proc/615/cmdline	pkill
File opened for reading	/proc/837/status	pkill
File opened for reading	/proc/913/status	pkill
File opened for reading	/proc/1103/status	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/1030/status	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/394/status	pkill
File opened for reading	/proc/168/status	pkill
File opened for reading	/proc/11/cmdline
File opened for reading	/proc/622/status	pkill
File opened for reading	/proc/837/status	pkill
File opened for reading	/proc/1406/status	pkill
File opened for reading	/proc/1317/cmdline	pkill
File opened for reading	/proc/1085/status	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/806/status	pkill
File opened for reading	/proc/612/status	pkill
File opened for reading	/proc/1294/cmdline	pkill
File opened for reading	/proc/1074/cmdline	pkill
File opened for reading	/proc/1030/status	pkill
File opened for reading	/proc/1473/status	pkill
File opened for reading	/proc/470/cmdline	pkill
File opened for reading	/proc/514/status	pkill
File opened for reading	/proc/158/status	pkill
File opened for reading	/proc/642/status	pkill
File opened for reading	/proc/978/cmdline	pkill
File opened for reading	/proc/75/cmdline
File opened for reading	/proc/937/cmdline
File opened for reading	/proc/1403/cmdline
File opened for reading	/proc/612/status	pkill
File opened for reading	/proc/642/status	pkill
File opened for reading	/proc/781/status	pkill
File opened for reading	/proc/1085/cmdline	pkill
File opened for reading	/proc/1406/cmdline	pkill
File opened for reading	/proc/75/status	pkill
File opened for reading	/proc/90/cmdline	pkill
File opened for reading	/proc/102/status	pkill
File opened for reading	/proc/1442/status	pkill
File opened for reading	/proc/1040/status	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/958/status	pkill
File opened for reading	/proc/668/cmdline	pkill
File opened for reading	/proc/969/status	pkill
File opened for reading	/proc/1144/cmdline	pkill
File opened for reading	/proc/93/cmdline
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/73/cmdline	pkill
File opened for reading	/proc/556/cmdline	pkill
File opened for reading	/proc/494/status	pkill
File opened for reading	/proc/1478/status	pkill
File opened for reading	/proc/1482/cmdline	pkill
File opened for reading	/proc/201/status	pkill
File opened for reading	/proc/453/status	pkill
File opened for reading	/proc/1085/status	pkill
File opened for reading	/proc/84/status	pkill
File opened for reading	/proc/502/status	pkill

/tmp/648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf
/tmp/648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf
1⤵
- Changes its process name
- Deletes itself
- Modifies Watchdog functionality
PID:1471

/usr/local/sbin/pkill
pkill tshark
1⤵
PID:1475

/usr/local/bin/pkill
pkill tshark
1⤵
PID:1475

/usr/sbin/pkill
pkill tshark
1⤵
PID:1475

/usr/bin/pkill
pkill tshark
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1475

/usr/local/sbin/pkill
pkill tcpdump
1⤵
PID:1474

/usr/local/sbin/pkill
pkill wireshark
1⤵
PID:1476

/usr/local/bin/pkill
pkill tcpdump
1⤵
PID:1474

/usr/local/bin/pkill
pkill wireshark
1⤵
PID:1476

/usr/sbin/pkill
pkill tcpdump
1⤵
PID:1474

/usr/bin/pkill
pkill tcpdump
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1474

/usr/sbin/pkill
pkill wireshark
1⤵
PID:1476

/usr/local/sbin/pkill
pkill dumpcap
1⤵
PID:1477

/usr/bin/pkill
pkill wireshark
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1476

/usr/local/bin/pkill
pkill dumpcap
1⤵
PID:1477

/usr/local/sbin/pkill
pkill ettercap
1⤵
PID:1478

/usr/sbin/pkill
pkill dumpcap
1⤵
PID:1477

/usr/local/bin/pkill
pkill ettercap
1⤵
PID:1478

/usr/bin/pkill
pkill dumpcap
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1477

/usr/local/sbin/pkill
pkill dsniff
1⤵
PID:1479

/usr/sbin/pkill
pkill ettercap
1⤵
PID:1478

/usr/local/bin/pkill
pkill dsniff
1⤵
PID:1479

/usr/bin/pkill
pkill ettercap
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1478

/usr/local/sbin/pkill
pkill ngrep
1⤵
PID:1480

/usr/sbin/pkill
pkill dsniff
1⤵
PID:1479

/usr/bin/pkill
pkill dsniff
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1479

/usr/local/bin/pkill
pkill ngrep
1⤵
PID:1480

/usr/local/sbin/pkill
pkill tcpflow
1⤵
PID:1481

/usr/sbin/pkill
pkill ngrep
1⤵
PID:1480

/usr/bin/pkill
pkill ngrep
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1480

/usr/local/sbin/pkill
pkill windump
1⤵
PID:1482

/usr/local/bin/pkill
pkill tcpflow
1⤵
PID:1481

/usr/local/bin/pkill
pkill windump
1⤵
PID:1482

/usr/local/sbin/pkill
pkill netsniff-ng
1⤵
PID:1483

/usr/sbin/pkill
pkill tcpflow
1⤵
PID:1481

/usr/sbin/pkill
pkill windump
1⤵
PID:1482

/usr/bin/pkill
pkill tcpflow
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1481

/usr/bin/pkill
pkill windump
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1482

/usr/local/bin/pkill
pkill netsniff-ng
1⤵
PID:1483

/usr/sbin/pkill
pkill netsniff-ng
1⤵
PID:1483

/usr/bin/pkill
pkill netsniff-ng
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1483

/usr/local/sbin/rm
rm -rf /usr/bin/ettercap
1⤵
PID:1511

/usr/local/sbin/rm
rm -rf /usr/bin/dsniff
1⤵
PID:1512

/usr/local/sbin/rm
rm -rf /usr/bin/ngrep
1⤵
PID:1513

/usr/local/sbin/rm
rm -rf /usr/bin/tcpflow
1⤵
PID:1514

/usr/local/sbin/rm
rm -rf /usr/bin/netsniff-ng
1⤵
PID:1516

/usr/local/sbin/rm
rm -rf /usr/sbin/ngrep
1⤵
PID:1503

/usr/local/sbin/rm
rm -rf /usr/sbin/tcpflow
1⤵
PID:1504

/usr/local/sbin/rm
rm -rf /usr/sbin/windump
1⤵
PID:1505

/usr/local/sbin/rm
rm -rf /usr/sbin/netsniff-ng
1⤵
PID:1506

/usr/local/sbin/rm
rm -rf /usr/bin/tcpdump
1⤵
PID:1507

/usr/local/sbin/rm
rm -rf /usr/bin/tshark
1⤵
PID:1508

/usr/local/sbin/rm
rm -rf /usr/bin/wireshark
1⤵
PID:1509

/usr/local/sbin/rm
rm -rf /usr/bin/dumpcap
1⤵
PID:1510

/usr/local/sbin/rm
rm -rf /usr/bin/windump
1⤵
PID:1515

/usr/local/bin/rm
rm -rf /usr/bin/windump
1⤵
PID:1515

/usr/local/bin/rm
rm -rf /usr/bin/tcpflow
1⤵
PID:1514

/usr/local/bin/rm
rm -rf /usr/bin/wireshark
1⤵
PID:1509

/usr/local/bin/rm
rm -rf /usr/bin/ngrep
1⤵
PID:1513

/usr/local/bin/rm
rm -rf /usr/sbin/ngrep
1⤵
PID:1503

/usr/local/bin/rm
rm -rf /usr/bin/dumpcap
1⤵
PID:1510

/usr/local/bin/rm
rm -rf /usr/bin/tcpdump
1⤵
PID:1507

/usr/local/bin/rm
rm -rf /usr/sbin/windump
1⤵
PID:1505

/usr/local/bin/rm
rm -rf /usr/bin/tshark
1⤵
PID:1508

/usr/local/bin/rm
rm -rf /usr/bin/netsniff-ng
1⤵
PID:1516

/usr/local/bin/rm
rm -rf /usr/sbin/tcpflow
1⤵
PID:1504

/usr/local/bin/rm
rm -rf /usr/sbin/netsniff-ng
1⤵
PID:1506

/usr/local/bin/rm
rm -rf /usr/bin/dsniff
1⤵
PID:1512

/usr/local/sbin/rm
rm -rf /usr/sbin/dsniff
1⤵
PID:1502

/usr/local/bin/rm
rm -rf /usr/bin/ettercap
1⤵
PID:1511

/usr/sbin/rm
rm -rf /usr/sbin/windump
1⤵
PID:1505

/usr/sbin/rm
rm -rf /usr/bin/dumpcap
1⤵
PID:1510

/usr/sbin/rm
rm -rf /usr/bin/netsniff-ng
1⤵
PID:1516

/usr/sbin/rm
rm -rf /usr/bin/ngrep
1⤵
PID:1513

/usr/sbin/rm
rm -rf /usr/bin/tcpflow
1⤵
PID:1514

/usr/sbin/rm
rm -rf /usr/bin/tcpdump
1⤵
PID:1507

/usr/sbin/rm
rm -rf /usr/sbin/netsniff-ng
1⤵
PID:1506

/usr/sbin/rm
rm -rf /usr/bin/wireshark
1⤵
PID:1509

/usr/sbin/rm
rm -rf /usr/bin/tshark
1⤵
PID:1508

/usr/sbin/rm
rm -rf /usr/sbin/ngrep
1⤵
PID:1503

/usr/sbin/rm
rm -rf /usr/sbin/tcpflow
1⤵
PID:1504

/usr/sbin/rm
rm -rf /usr/bin/dsniff
1⤵
PID:1512

/usr/sbin/rm
rm -rf /usr/bin/windump
1⤵
PID:1515

/usr/sbin/rm
rm -rf /usr/bin/ettercap
1⤵
PID:1511

/usr/local/bin/rm
rm -rf /usr/sbin/dsniff
1⤵
PID:1502

/usr/bin/rm
rm -rf /usr/bin/wireshark
1⤵
PID:1509

/usr/bin/rm
rm -rf /usr/sbin/ngrep
1⤵
PID:1503

/usr/bin/rm
rm -rf /usr/sbin/netsniff-ng
1⤵
PID:1506

/usr/bin/rm
rm -rf /usr/bin/netsniff-ng
1⤵
PID:1516

/usr/bin/rm
rm -rf /usr/bin/tshark
1⤵
PID:1508

/usr/bin/rm
rm -rf /usr/bin/tcpdump
1⤵
PID:1507

/usr/bin/rm
rm -rf /usr/sbin/tcpflow
1⤵
PID:1504

/usr/bin/rm
rm -rf /usr/bin/tcpflow
1⤵
PID:1514

/usr/bin/rm
rm -rf /usr/bin/dumpcap
1⤵
PID:1510

/usr/bin/rm
rm -rf /usr/sbin/windump
1⤵
PID:1505

/usr/bin/rm
rm -rf /usr/bin/dsniff
1⤵
PID:1512

/usr/bin/rm
rm -rf /usr/bin/windump
1⤵
PID:1515

/usr/bin/rm
rm -rf /usr/bin/ettercap
1⤵
PID:1511

/usr/bin/rm
rm -rf /usr/bin/ngrep
1⤵
PID:1513

/usr/local/sbin/rm
rm -rf /usr/sbin/ettercap
1⤵
PID:1501

/usr/sbin/rm
rm -rf /usr/sbin/dsniff
1⤵
PID:1502

/usr/bin/rm
rm -rf /usr/sbin/dsniff
1⤵
PID:1502

/usr/local/bin/rm
rm -rf /usr/sbin/ettercap
1⤵
PID:1501

/usr/local/sbin/rm
rm -rf /usr/sbin/wireshark
1⤵
PID:1499

/usr/sbin/rm
rm -rf /usr/sbin/ettercap
1⤵
PID:1501

/usr/local/sbin/rm
rm -rf /usr/sbin/dumpcap
1⤵
PID:1500

/usr/local/bin/rm
rm -rf /usr/sbin/wireshark
1⤵
PID:1499

/usr/bin/rm
rm -rf /usr/sbin/ettercap
1⤵
PID:1501

/usr/local/bin/rm
rm -rf /usr/sbin/dumpcap
1⤵
PID:1500

/usr/sbin/rm
rm -rf /usr/sbin/wireshark
1⤵
PID:1499

/usr/bin/rm
rm -rf /usr/sbin/wireshark
1⤵
PID:1499

/usr/sbin/rm
rm -rf /usr/sbin/dumpcap
1⤵
PID:1500

/usr/bin/rm
rm -rf /usr/sbin/dumpcap
1⤵
PID:1500

/usr/local/sbin/rm
rm -rf /usr/sbin/tshark
1⤵
PID:1498

/usr/local/bin/rm
rm -rf /usr/sbin/tshark
1⤵
PID:1498

/usr/sbin/rm
rm -rf /usr/sbin/tshark
1⤵
PID:1498

/usr/bin/rm
rm -rf /usr/sbin/tshark
1⤵
PID:1498

/usr/local/sbin/rm
rm -rf /usr/sbin/tcpdump
1⤵
PID:1497

/usr/local/bin/rm
rm -rf /usr/sbin/tcpdump
1⤵
PID:1497

/usr/sbin/rm
rm -rf /usr/sbin/tcpdump
1⤵
PID:1497

/usr/bin/rm
rm -rf /usr/sbin/tcpdump
1⤵
PID:1497

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads