Resubmissions
28-04-2024 19:36
240428-ybn2tsff8v 1028-04-2024 19:22
240428-x3cbnsfd2t 1028-04-2024 19:18
240428-xz2gdseh66 1028-04-2024 19:07
240428-xsyrxsfa5x 1Analysis
-
max time kernel
0s -
max time network
112s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
28-04-2024 19:22
Static task
static1
Behavioral task
behavioral1
Sample
k.elf
Resource
ubuntu1804-amd64-20240226-en
General
-
Target
k.elf
-
Size
1.5MB
-
MD5
cfb6d21ffe7c4279f761f2351c0810ee
-
SHA1
ee827023780964574f28c6ba333d800b73eae5c4
-
SHA256
95776f31cbcac08eb3f3e9235d07513a6d7a6bf9f1b7f3d400b2cf0afdb088a7
-
SHA512
c24342fe718d9cd8be98741cb7962b39cdf887b855ac0d7d6c0bbdd346fffd3f1dd1bdb91728bd16efe61456792fcc70b17e6f98cc052e229d186f1d7a28a9b8
-
SSDEEP
24576:t4mEitdoHarsfZqy5hEiefNvF6pVuQYGM:tdE2dxrUqy5ep5F6mQlM
Malware Config
Extracted
/tmp/readme.txt
conti
http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/ykCDUCsFcCYo8BNSsvH2TZTvCnEUM30XKoeCZiXUQEjPnzp1nee2ivFY0hAf7frb
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Writes file to tmp directory 23 IoCs
Malware often drops required files in the /tmp directory.
Processes:
k.elfdescription ioc Process File opened for modification /tmp/result.txt k.elf File opened for modification /tmp/snap-private-tmp/readme.txt k.elf File opened for modification /tmp/systemd-private-7aa933f606574ae69f409eba76924c33-colord.service-dittsz/readme.txt k.elf File opened for modification /tmp/systemd-private-7aa933f606574ae69f409eba76924c33-systemd-timedated.service-5LSeY4/readme.txt k.elf File opened for modification /tmp/systemd-private-7aa933f606574ae69f409eba76924c33-systemd-timedated.service-5LSeY4/tmp/readme.txt k.elf File opened for modification /tmp/systemd-private-7aa933f606574ae69f409eba76924c33-ModemManager.service-zyvdsu/tmp/readme.txt k.elf File opened for modification /tmp/systemd-private-7aa933f606574ae69f409eba76924c33-systemd-resolved.service-pqTkDU/tmp/readme.txt k.elf File opened for modification /tmp/systemd-private-7aa933f606574ae69f409eba76924c33-fwupd.service-TwXZiX/tmp/readme.txt k.elf File opened for modification /tmp/systemd-private-7aa933f606574ae69f409eba76924c33-colord.service-dittsz/tmp/readme.txt k.elf File opened for modification /tmp/.ICE-unix/readme.txt k.elf File opened for modification /tmp/systemd-private-7aa933f606574ae69f409eba76924c33-ModemManager.service-zyvdsu/readme.txt k.elf File opened for modification /tmp/ssh-hERvxlFPp1bH/readme.txt k.elf File opened for modification /tmp/readme.txt k.elf File opened for modification /tmp/systemd-private-7aa933f606574ae69f409eba76924c33-bolt.service-LvnI5y/tmp/readme.txt k.elf File opened for modification /tmp/.Test-unix/readme.txt k.elf File opened for modification /tmp/.font-unix/readme.txt k.elf File opened for modification /tmp/.X11-unix/readme.txt k.elf File opened for modification /tmp/systemd-private-7aa933f606574ae69f409eba76924c33-systemd-resolved.service-pqTkDU/readme.txt k.elf File opened for modification /tmp/systemd-private-7aa933f606574ae69f409eba76924c33-fwupd.service-TwXZiX/readme.txt k.elf File opened for modification /tmp/.XIM-unix/readme.txt k.elf File opened for modification /tmp/systemd-private-7aa933f606574ae69f409eba76924c33-bolt.service-LvnI5y/readme.txt k.elf File opened for modification /tmp/k.elf k.elf File opened for modification /tmp/netplan_jjrlvtlq/readme.txt k.elf
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f2ec65b6ccc5e28343ce62a48279027f
SHA17ef88d7845747810a522b73b48f85774cc3d5d0e
SHA256a01e047b193671716125c6cf06171b0b0cac332631065ea5320fff4be0971582
SHA512b48e8c82812e03afbc39f55f59e5110d181b107000c87491eb6adfebe19b7a3679dac6debb5fd0319afb53a12ed476dd4d5212aa5470e8b015ff1abdb3ce1b38
-
Filesize
33B
MD5e7e930dbed22a8a67cfcd9c510268087
SHA11e19959cb6ac9c43da3c142c72fa71163f261095
SHA256b61d766a605a6c97ee10e601e707996734cb6a538356aeaa237903c3040e8303
SHA512c04c113344e21a79156bbd3cb86e74e584e5d154e5ce04f9fcad5184e0c2355dd7d6767b45bbb9fce720eed36cbcd36f4f9aa981e682a03f957c07a219dac931