Analysis
-
max time kernel
16s -
max time network
20s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
24-04-2024 19:18
Behavioral task
behavioral1
Sample
x86_32
Resource
ubuntu2004-amd64-20240221-en
5 signatures
150 seconds
General
-
Target
x86_32
-
Size
100KB
-
MD5
f52ac51a1924f1b04661b0bf1a5aa545
-
SHA1
18df6df4fd93c87974f227e23f13dcc87b7ef3b8
-
SHA256
08b72566507c0e07d6c3b6091b7de57b714eb0ac8404a93b1e830f7f8f5f5977
-
SHA512
5298a765cfd9663c7aca5ad7f5f046ae6331509a117b53d1265a14c19731ac6a012236234e00c77fffeff6c0ef27e931e1f88b79ee5dcdfb52d9734304295751
-
SSDEEP
1536:fykodiwJrj3LD2IYNjQ5ZyItGo8YSP7aUwIq1y7YuczGI:fGdiKrbLL5ZGoBIq1KVFI
Score
9/10
Malware Config
Signatures
-
Contacts a large (16789) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
Processes:
x86_32description ioc pid process Changes the process name, possibly in an attempt to hide itself a 1465 x86_32 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
x86_32description ioc process File opened for reading /proc/16/cmdline x86_32 File opened for reading /proc/265/cmdline x86_32 File opened for reading /proc/105/maps x86_32 File opened for reading /proc/167/maps x86_32 File opened for reading /proc/172/maps x86_32 File opened for reading /proc/1048/maps x86_32 File opened for reading /proc/1143/cmdline x86_32 File opened for reading /proc/89/maps x86_32 File opened for reading /proc/458/cmdline x86_32 File opened for reading /proc/801/cmdline x86_32 File opened for reading /proc/1410/cmdline x86_32 File opened for reading /proc/1636/maps x86_32 File opened for reading /proc/589/cmdline x86_32 File opened for reading /proc/952/cmdline x86_32 File opened for reading /proc/975/cmdline x86_32 File opened for reading /proc/3/maps x86_32 File opened for reading /proc/1035/maps x86_32 File opened for reading /proc/1405/maps x86_32 File opened for reading /proc/1440/maps x86_32 File opened for reading /proc/175/cmdline x86_32 File opened for reading /proc/1148/cmdline x86_32 File opened for reading /proc/79/maps x86_32 File opened for reading /proc/1415/cmdline x86_32 File opened for reading /proc/1479/cmdline x86_32 File opened for reading /proc/1537/maps x86_32 File opened for reading /proc/675/cmdline x86_32 File opened for reading /proc/173/maps x86_32 File opened for reading /proc/1/cmdline x86_32 File opened for reading /proc/20/cmdline x86_32 File opened for reading /proc/77/cmdline x86_32 File opened for reading /proc/518/cmdline x86_32 File opened for reading /proc/505/cmdline x86_32 File opened for reading /proc/2/maps x86_32 File opened for reading /proc/785/maps x86_32 File opened for reading /proc/1422/maps x86_32 File opened for reading /proc/71/cmdline x86_32 File opened for reading /proc/200/cmdline x86_32 File opened for reading /proc/980/maps x86_32 File opened for reading /proc/1811/cmdline x86_32 File opened for reading /proc/815/maps x86_32 File opened for reading /proc/1099/maps x86_32 File opened for reading /proc/1137/maps x86_32 File opened for reading /proc/1296/maps x86_32 File opened for reading /proc/1131/cmdline x86_32 File opened for reading /proc/1763/maps x86_32 File opened for reading /proc/87/maps x86_32 File opened for reading /proc/906/maps x86_32 File opened for reading /proc/1048/cmdline x86_32 File opened for reading /proc/5/cmdline x86_32 File opened for reading /proc/70/cmdline x86_32 File opened for reading /proc/639/cmdline x86_32 File opened for reading /proc/84/maps x86_32 File opened for reading /proc/1296/cmdline x86_32 File opened for reading /proc/165/cmdline x86_32 File opened for reading /proc/1426/cmdline x86_32 File opened for reading /proc/1515/cmdline x86_32 File opened for reading /proc/1626/maps x86_32 File opened for reading /proc/72/maps x86_32 File opened for reading /proc/170/maps x86_32 File opened for reading /proc/964/maps x86_32 File opened for reading /proc/1466/maps x86_32 File opened for reading /proc/810/cmdline x86_32 File opened for reading /proc/89/cmdline x86_32 File opened for reading /proc/790/cmdline x86_32