Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
17-04-2024 13:34
Behavioral task
behavioral1
Sample
648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf
Resource
ubuntu1804-amd64-20240226-en
General
-
Target
648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf
-
Size
74KB
-
MD5
20d263bd6e0552cad17ec45eeff1844b
-
SHA1
67a23901d5f3276ba4e8c95c21aeb79ca584a36a
-
SHA256
648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b
-
SHA512
f721ddcbcb19d22057d8a4b7402fa8d852872b3df3de18a13b8c983407fb29cd06ef7b9c35c4c50a179ac98fd2e70296806487fc59d4a9e291fa248662ac5eef
-
SSDEEP
1536:EUPldq0TJFnqXKvdo7DYZXjs56tbWuhyN/XemIdRI1R+5vY1SLq7wTVVi:9NdDznqoK7D4s5UWxem0I1R+JeSOcTf
Malware Config
Signatures
-
Changes its process name 1 IoCs
Processes:
648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself 5awto8gpm0ftqfwr60cwiafpkigt7u5t 1518 648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf -
Deletes itself 1 IoCs
Processes:
648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elfpid process 1518 648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf -
Processes:
description ioc File deleted /var/log/journal/11c67417355f45d397f6be11f62e85a6/system.journal -
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elfdescription ioc process File opened for modification /dev/watchdog 648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf File opened for modification /dev/misc/watchdog 648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 10 IoCs
Processes:
pkillpkillpkillpkillpkillpkillpkillpkillpkillpkilldescription ioc process File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
pkillpkillpkillpkillpkillpkillpkillpkillpkillpkilldescription ioc process File opened for reading /proc/83/cmdline pkill File opened for reading /proc/466/status pkill File opened for reading /proc/1043/status pkill File opened for reading /proc/1113/cmdline pkill File opened for reading /proc/6/cmdline pkill File opened for reading /proc/408/status pkill File opened for reading /proc/1318/cmdline pkill File opened for reading /proc/13/cmdline pkill File opened for reading /proc/653/status pkill File opened for reading /proc/722/cmdline pkill File opened for reading /proc/155/status pkill File opened for reading /proc/1127/cmdline pkill File opened for reading /proc/1161/status pkill File opened for reading /proc/26/cmdline File opened for reading /proc/414/status pkill File opened for reading /proc/13/status pkill File opened for reading /proc/666/status pkill File opened for reading /proc/722/status pkill File opened for reading /proc/19/status pkill File opened for reading /proc/472/cmdline File opened for reading /proc/162/status pkill File opened for reading /proc/653/cmdline pkill File opened for reading /proc/1523/status pkill File opened for reading /proc/1567/cmdline File opened for reading /proc/547/cmdline pkill File opened for reading /proc/466/cmdline pkill File opened for reading /proc/947/cmdline pkill File opened for reading /proc/1169/cmdline pkill File opened for reading /proc/1191/status pkill File opened for reading /proc/156/status pkill File opened for reading /proc/30/cmdline pkill File opened for reading /proc/411/cmdline pkill File opened for reading /proc/1512/cmdline pkill File opened for reading /proc/1513/cmdline pkill File opened for reading /proc/30/cmdline pkill File opened for reading /proc/1191/status pkill File opened for reading /proc/165/status pkill File opened for reading /proc/248/status pkill File opened for reading /proc/1099/status pkill File opened for reading /proc/1154/cmdline pkill File opened for reading /proc/1182/cmdline pkill File opened for reading /proc/547/cmdline File opened for reading /proc/157/status pkill File opened for reading /proc/1115/cmdline pkill File opened for reading /proc/1525/cmdline pkill File opened for reading /proc/78/cmdline pkill File opened for reading /proc/1295/status pkill File opened for reading /proc/1288/cmdline pkill File opened for reading /proc/1512/cmdline pkill File opened for reading /proc/958/cmdline pkill File opened for reading /proc/165/cmdline pkill File opened for reading /proc/268/cmdline pkill File opened for reading /proc/1288/cmdline pkill File opened for reading /proc/161/cmdline pkill File opened for reading /proc/1244/cmdline pkill File opened for reading /proc/1431/cmdline File opened for reading /proc/22/cmdline pkill File opened for reading /proc/167/cmdline pkill File opened for reading /proc/509/status pkill File opened for reading /proc/1191/status pkill File opened for reading /proc/1/status pkill File opened for reading /proc/1318/status pkill File opened for reading /proc/248/cmdline pkill File opened for reading /proc/2/cmdline pkill
Processes
-
/tmp/648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf/tmp/648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b.elf1⤵
- Changes its process name
- Deletes itself
- Modifies Watchdog functionality
PID:1518
-
/usr/local/sbin/pkillpkill dumpcap1⤵PID:1523
-
/usr/local/bin/pkillpkill dumpcap1⤵PID:1523
-
/usr/sbin/pkillpkill dumpcap1⤵PID:1523
-
/usr/bin/pkillpkill dumpcap1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1523
-
/usr/local/sbin/pkillpkill ettercap1⤵PID:1524
-
/usr/local/bin/pkillpkill ettercap1⤵PID:1524
-
/usr/sbin/pkillpkill ettercap1⤵PID:1524
-
/usr/bin/pkillpkill ettercap1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1524
-
/usr/local/sbin/pkillpkill wireshark1⤵PID:1522
-
/usr/local/bin/pkillpkill wireshark1⤵PID:1522
-
/usr/sbin/pkillpkill wireshark1⤵PID:1522
-
/usr/bin/pkillpkill wireshark1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1522
-
/usr/local/sbin/pkillpkill dsniff1⤵PID:1525
-
/usr/local/bin/pkillpkill dsniff1⤵PID:1525
-
/usr/sbin/pkillpkill dsniff1⤵PID:1525
-
/usr/bin/pkillpkill dsniff1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1525
-
/usr/local/sbin/pkillpkill ngrep1⤵PID:1526
-
/usr/local/bin/pkillpkill ngrep1⤵PID:1526
-
/usr/sbin/pkillpkill ngrep1⤵PID:1526
-
/usr/bin/pkillpkill ngrep1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1526
-
/usr/local/sbin/pkillpkill tshark1⤵PID:1521
-
/usr/local/bin/pkillpkill tshark1⤵PID:1521
-
/usr/sbin/pkillpkill tshark1⤵PID:1521
-
/usr/bin/pkillpkill tshark1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1521
-
/usr/local/sbin/pkillpkill tcpflow1⤵PID:1527
-
/usr/local/bin/pkillpkill tcpflow1⤵PID:1527
-
/usr/sbin/pkillpkill tcpflow1⤵PID:1527
-
/usr/local/sbin/pkillpkill windump1⤵PID:1528
-
/usr/local/sbin/pkillpkill netsniff-ng1⤵PID:1529
-
/usr/bin/pkillpkill tcpflow1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1527
-
/usr/local/bin/pkillpkill windump1⤵PID:1528
-
/usr/local/bin/pkillpkill netsniff-ng1⤵PID:1529
-
/usr/sbin/pkillpkill windump1⤵PID:1528
-
/usr/sbin/pkillpkill netsniff-ng1⤵PID:1529
-
/usr/bin/pkillpkill windump1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1528
-
/usr/bin/pkillpkill netsniff-ng1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1529
-
/usr/local/sbin/pkillpkill tcpdump1⤵PID:1520
-
/usr/local/bin/pkillpkill tcpdump1⤵PID:1520
-
/usr/sbin/pkillpkill tcpdump1⤵PID:1520
-
/usr/bin/pkillpkill tcpdump1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1520
-
/usr/local/sbin/rmrm -rf /usr/bin/ettercap1⤵PID:1547
-
/usr/local/bin/rmrm -rf /usr/bin/ettercap1⤵PID:1547
-
/usr/sbin/rmrm -rf /usr/bin/ettercap1⤵PID:1547
-
/usr/bin/rmrm -rf /usr/bin/ettercap1⤵PID:1547
-
/sbin/rmrm -rf /usr/bin/ettercap1⤵PID:1547
-
/bin/rmrm -rf /usr/bin/ettercap1⤵PID:1547
-
/usr/local/sbin/rmrm -rf /usr/bin/dsniff1⤵PID:1548
-
/usr/local/bin/rmrm -rf /usr/bin/dsniff1⤵PID:1548
-
/usr/sbin/rmrm -rf /usr/bin/dsniff1⤵PID:1548
-
/usr/bin/rmrm -rf /usr/bin/dsniff1⤵PID:1548
-
/sbin/rmrm -rf /usr/bin/dsniff1⤵PID:1548
-
/bin/rmrm -rf /usr/bin/dsniff1⤵PID:1548
-
/usr/local/sbin/rmrm -rf /usr/bin/ngrep1⤵PID:1549
-
/usr/local/bin/rmrm -rf /usr/bin/ngrep1⤵PID:1549
-
/usr/sbin/rmrm -rf /usr/bin/ngrep1⤵PID:1549
-
/usr/bin/rmrm -rf /usr/bin/ngrep1⤵PID:1549
-
/sbin/rmrm -rf /usr/bin/ngrep1⤵PID:1549
-
/bin/rmrm -rf /usr/bin/ngrep1⤵PID:1549
-
/usr/local/sbin/rmrm -rf /usr/bin/tcpflow1⤵PID:1550
-
/usr/local/bin/rmrm -rf /usr/bin/tcpflow1⤵PID:1550
-
/usr/sbin/rmrm -rf /usr/bin/tcpflow1⤵PID:1550
-
/usr/bin/rmrm -rf /usr/bin/tcpflow1⤵PID:1550
-
/sbin/rmrm -rf /usr/bin/tcpflow1⤵PID:1550
-
/bin/rmrm -rf /usr/bin/tcpflow1⤵PID:1550
-
/usr/local/sbin/rmrm -rf /usr/bin/netsniff-ng1⤵PID:1552
-
/usr/local/bin/rmrm -rf /usr/bin/netsniff-ng1⤵PID:1552
-
/usr/sbin/rmrm -rf /usr/bin/netsniff-ng1⤵PID:1552
-
/usr/bin/rmrm -rf /usr/bin/netsniff-ng1⤵PID:1552
-
/sbin/rmrm -rf /usr/bin/netsniff-ng1⤵PID:1552
-
/bin/rmrm -rf /usr/bin/netsniff-ng1⤵PID:1552
-
/usr/local/sbin/rmrm -rf /usr/sbin/ngrep1⤵PID:1539
-
/usr/local/bin/rmrm -rf /usr/sbin/ngrep1⤵PID:1539
-
/usr/sbin/rmrm -rf /usr/sbin/ngrep1⤵PID:1539
-
/usr/bin/rmrm -rf /usr/sbin/ngrep1⤵PID:1539
-
/sbin/rmrm -rf /usr/sbin/ngrep1⤵PID:1539
-
/bin/rmrm -rf /usr/sbin/ngrep1⤵PID:1539
-
/usr/local/sbin/rmrm -rf /usr/sbin/tcpflow1⤵PID:1540
-
/usr/local/bin/rmrm -rf /usr/sbin/tcpflow1⤵PID:1540
-
/usr/sbin/rmrm -rf /usr/sbin/tcpflow1⤵PID:1540
-
/usr/bin/rmrm -rf /usr/sbin/tcpflow1⤵PID:1540
-
/sbin/rmrm -rf /usr/sbin/tcpflow1⤵PID:1540
-
/bin/rmrm -rf /usr/sbin/tcpflow1⤵PID:1540
-
/usr/local/sbin/rmrm -rf /usr/sbin/windump1⤵PID:1541
-
/usr/local/bin/rmrm -rf /usr/sbin/windump1⤵PID:1541
-
/usr/sbin/rmrm -rf /usr/sbin/windump1⤵PID:1541
-
/usr/bin/rmrm -rf /usr/sbin/windump1⤵PID:1541
-
/sbin/rmrm -rf /usr/sbin/windump1⤵PID:1541
-
/bin/rmrm -rf /usr/sbin/windump1⤵PID:1541
-
/usr/local/sbin/rmrm -rf /usr/sbin/netsniff-ng1⤵PID:1542
-
/usr/local/bin/rmrm -rf /usr/sbin/netsniff-ng1⤵PID:1542
-
/usr/sbin/rmrm -rf /usr/sbin/netsniff-ng1⤵PID:1542
-
/usr/bin/rmrm -rf /usr/sbin/netsniff-ng1⤵PID:1542
-
/sbin/rmrm -rf /usr/sbin/netsniff-ng1⤵PID:1542
-
/bin/rmrm -rf /usr/sbin/netsniff-ng1⤵PID:1542
-
/usr/local/sbin/rmrm -rf /usr/bin/tcpdump1⤵PID:1543
-
/usr/local/bin/rmrm -rf /usr/bin/tcpdump1⤵PID:1543
-
/usr/sbin/rmrm -rf /usr/bin/tcpdump1⤵PID:1543
-
/usr/bin/rmrm -rf /usr/bin/tcpdump1⤵PID:1543
-
/sbin/rmrm -rf /usr/bin/tcpdump1⤵PID:1543
-
/bin/rmrm -rf /usr/bin/tcpdump1⤵PID:1543
-
/usr/local/sbin/rmrm -rf /usr/bin/tshark1⤵PID:1544
-
/usr/local/bin/rmrm -rf /usr/bin/tshark1⤵PID:1544
-
/usr/sbin/rmrm -rf /usr/bin/tshark1⤵PID:1544
-
/usr/bin/rmrm -rf /usr/bin/tshark1⤵PID:1544
-
/sbin/rmrm -rf /usr/bin/tshark1⤵PID:1544
-
/bin/rmrm -rf /usr/bin/tshark1⤵PID:1544
-
/usr/local/sbin/rmrm -rf /usr/bin/wireshark1⤵PID:1545
-
/usr/local/bin/rmrm -rf /usr/bin/wireshark1⤵PID:1545
-
/usr/sbin/rmrm -rf /usr/bin/wireshark1⤵PID:1545
-
/usr/bin/rmrm -rf /usr/bin/wireshark1⤵PID:1545
-
/sbin/rmrm -rf /usr/bin/wireshark1⤵PID:1545
-
/bin/rmrm -rf /usr/bin/wireshark1⤵PID:1545
-
/usr/local/sbin/rmrm -rf /usr/bin/dumpcap1⤵PID:1546
-
/usr/local/bin/rmrm -rf /usr/bin/dumpcap1⤵PID:1546
-
/usr/sbin/rmrm -rf /usr/bin/dumpcap1⤵PID:1546
-
/usr/bin/rmrm -rf /usr/bin/dumpcap1⤵PID:1546
-
/sbin/rmrm -rf /usr/bin/dumpcap1⤵PID:1546
-
/bin/rmrm -rf /usr/bin/dumpcap1⤵PID:1546
-
/usr/local/sbin/rmrm -rf /usr/bin/windump1⤵PID:1551
-
/usr/local/bin/rmrm -rf /usr/bin/windump1⤵PID:1551
-
/usr/sbin/rmrm -rf /usr/bin/windump1⤵PID:1551
-
/usr/bin/rmrm -rf /usr/bin/windump1⤵PID:1551
-
/sbin/rmrm -rf /usr/bin/windump1⤵PID:1551
-
/bin/rmrm -rf /usr/bin/windump1⤵PID:1551
-
/usr/local/sbin/rmrm -rf /usr/sbin/dsniff1⤵PID:1538
-
/usr/local/bin/rmrm -rf /usr/sbin/dsniff1⤵PID:1538
-
/usr/sbin/rmrm -rf /usr/sbin/dsniff1⤵PID:1538
-
/usr/bin/rmrm -rf /usr/sbin/dsniff1⤵PID:1538
-
/sbin/rmrm -rf /usr/sbin/dsniff1⤵PID:1538
-
/bin/rmrm -rf /usr/sbin/dsniff1⤵PID:1538
-
/usr/local/sbin/rmrm -rf /usr/sbin/ettercap1⤵PID:1537
-
/usr/local/bin/rmrm -rf /usr/sbin/ettercap1⤵PID:1537
-
/usr/sbin/rmrm -rf /usr/sbin/ettercap1⤵PID:1537
-
/usr/bin/rmrm -rf /usr/sbin/ettercap1⤵PID:1537
-
/sbin/rmrm -rf /usr/sbin/ettercap1⤵PID:1537
-
/bin/rmrm -rf /usr/sbin/ettercap1⤵PID:1537
-
/usr/local/sbin/rmrm -rf /usr/sbin/dumpcap1⤵PID:1536
-
/usr/local/bin/rmrm -rf /usr/sbin/dumpcap1⤵PID:1536
-
/usr/sbin/rmrm -rf /usr/sbin/dumpcap1⤵PID:1536
-
/usr/bin/rmrm -rf /usr/sbin/dumpcap1⤵PID:1536
-
/sbin/rmrm -rf /usr/sbin/dumpcap1⤵PID:1536
-
/bin/rmrm -rf /usr/sbin/dumpcap1⤵PID:1536
-
/usr/local/sbin/rmrm -rf /usr/sbin/wireshark1⤵PID:1535
-
/usr/local/bin/rmrm -rf /usr/sbin/wireshark1⤵PID:1535
-
/usr/sbin/rmrm -rf /usr/sbin/wireshark1⤵PID:1535
-
/usr/bin/rmrm -rf /usr/sbin/wireshark1⤵PID:1535
-
/sbin/rmrm -rf /usr/sbin/wireshark1⤵PID:1535
-
/bin/rmrm -rf /usr/sbin/wireshark1⤵PID:1535
-
/usr/local/sbin/rmrm -rf /usr/sbin/tshark1⤵PID:1534
-
/usr/local/bin/rmrm -rf /usr/sbin/tshark1⤵PID:1534
-
/usr/sbin/rmrm -rf /usr/sbin/tshark1⤵PID:1534
-
/usr/bin/rmrm -rf /usr/sbin/tshark1⤵PID:1534
-
/sbin/rmrm -rf /usr/sbin/tshark1⤵PID:1534
-
/bin/rmrm -rf /usr/sbin/tshark1⤵PID:1534
-
/usr/local/sbin/rmrm -rf /usr/sbin/tcpdump1⤵PID:1533
-
/usr/local/bin/rmrm -rf /usr/sbin/tcpdump1⤵PID:1533
-
/usr/sbin/rmrm -rf /usr/sbin/tcpdump1⤵PID:1533
-
/usr/bin/rmrm -rf /usr/sbin/tcpdump1⤵PID:1533
-
/sbin/rmrm -rf /usr/sbin/tcpdump1⤵PID:1533
-
/bin/rmrm -rf /usr/sbin/tcpdump1⤵PID:1533