Resubmissions
28-04-2024 19:36
240428-ybn2tsff8v 1028-04-2024 19:22
240428-x3cbnsfd2t 1028-04-2024 19:18
240428-xz2gdseh66 1028-04-2024 19:07
240428-xsyrxsfa5x 1Analysis
-
max time kernel
12s -
max time network
16s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240418-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240418-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
28-04-2024 19:36
Static task
static1
Behavioral task
behavioral1
Sample
k.elf
Resource
ubuntu1804-amd64-20240418-en
Behavioral task
behavioral2
Sample
k.elf
Resource
ubuntu2004-amd64-20240418-en
General
-
Target
k.elf
-
Size
1.5MB
-
MD5
cfb6d21ffe7c4279f761f2351c0810ee
-
SHA1
ee827023780964574f28c6ba333d800b73eae5c4
-
SHA256
95776f31cbcac08eb3f3e9235d07513a6d7a6bf9f1b7f3d400b2cf0afdb088a7
-
SHA512
c24342fe718d9cd8be98741cb7962b39cdf887b855ac0d7d6c0bbdd346fffd3f1dd1bdb91728bd16efe61456792fcc70b17e6f98cc052e229d186f1d7a28a9b8
-
SSDEEP
24576:t4mEitdoHarsfZqy5hEiefNvF6pVuQYGM:tdE2dxrUqy5ep5F6mQlM
Malware Config
Extracted
/readme.txt
conti
http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/ykCDUCsFcCYo8BNSsvH2TZTvCnEUM30XKoeCZiXUQEjPnzp1nee2ivFY0hAf7frb
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Renames multiple (11437) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Creates/modifies Cron job 1 TTPs 5 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
k.elfdescription ioc Process File opened for modification /var/spool/cron/readme.txt k.elf File opened for modification /var/spool/cron/atspool/readme.txt k.elf File opened for modification /var/spool/cron/atjobs/readme.txt k.elf File opened for modification /var/spool/cron/atjobs/.SEQ k.elf File opened for modification /var/spool/cron/crontabs/readme.txt k.elf
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f2ec65b6ccc5e28343ce62a48279027f
SHA17ef88d7845747810a522b73b48f85774cc3d5d0e
SHA256a01e047b193671716125c6cf06171b0b0cac332631065ea5320fff4be0971582
SHA512b48e8c82812e03afbc39f55f59e5110d181b107000c87491eb6adfebe19b7a3679dac6debb5fd0319afb53a12ed476dd4d5212aa5470e8b015ff1abdb3ce1b38