ecddb54ebc92de3507152d3b0a2a5deaa46961554e5d24d72a2bd8ac9c9a48ea

General

Target

054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
Size

65KB
MD5

839c1f080d0a516cece812fa2b360782
SHA1

82fa5f538640a2c5cf8eb535cd6cc63c164144e4
SHA256

054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb
SHA512

b3f975fc4688ae17032eacf3fea83aa5dcfe352a8da8433ae366c951e5f0c69456d096ecce84708ce01e6292d13a1cb190e4bbbcd68cb7438f7d347b1e16ca79
SSDEEP

1536:R+XkIsiWIGc8k1KDVmUItipHOG/WtcR5RaCrZqfCxCEEru:R+XvsidGyKDVmUItiNOFeR5RaCl+9

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

pid

1465
Enumerates running processes
Discovers information about currently running processes on the system

pid
1465

Changes its process name 1 IoCs

Processes:

054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	httpd	1463	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf

description	ioc	process
File opened for reading	/proc/634/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/677/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/835/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/973/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/1074/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/13/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/74/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/269/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/1100/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/2/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/169/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/456/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/946/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/951/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/978/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/102/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/272/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/441/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/86/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/175/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/604/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/486/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/496/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/502/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/503/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/565/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/19/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/115/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/166/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/956/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/1095/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/670/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/928/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/935/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/1039/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/1094/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/105/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/159/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/165/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/1102/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/5/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/168/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/480/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/780/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/571/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/627/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/805/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/932/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/10/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/396/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/398/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/785/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/3/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/15/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/24/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/177/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/472/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/1043/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/442/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/680/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/927/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/92/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/167/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
File opened for reading	/proc/1099/cmdline	054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf

/tmp/054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
/tmp/054cac1cb6e624d93aac3074231554bf683185e9316504bdf26a3c758dd602fb.elf
1⤵
- Changes its process name
- Reads runtime system information
PID:1463

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads