Analysis
-
max time kernel
41s -
max time network
145s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
07/05/2024, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf
Resource
ubuntu1804-amd64-20240226-en
3 signatures
150 seconds
General
-
Target
07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf
-
Size
140KB
-
MD5
954f197268ee34446c11d97f48e7429a
-
SHA1
b4c39c39b9ac113e01f8b0cc791c02a629c6c5fd
-
SHA256
07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984
-
SHA512
d12fbe58cc70d6f09a3a59436fe90e80892b7e56c809b302a4c56c2d45f3273b4a39ae697768a74cdaf5292f187ded6eaeb8278e55aefdfa104da772ce176986
-
SSDEEP
3072:mTUTfCdO6FFto6O68wKhc/t/ekNaogMewcgsK027uTOlX:mTUTfCdO6FFto6VwwQdkX
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M"! 1576 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/11/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/24/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/127/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1319/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/3/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/187/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/894/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1286/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1140/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1232/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1449/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/81/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/179/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/465/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1088/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/182/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/480/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1169/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1311/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/185/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/433/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/729/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/959/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1074/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1167/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1259/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/21/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/23/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/28/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/175/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/17/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1574/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/25/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/190/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/463/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1204/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/20/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/30/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/177/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/464/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1055/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1555/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1573/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1577/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/27/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/31/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/83/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/678/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1171/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1269/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1570/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/8/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/268/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1026/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1165/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/35/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1076/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1335/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1578/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/5/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/78/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/491/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1196/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf File opened for reading /proc/1144/cmdline 07199802a39574e6a28e2967db181d69a93a92b464fc0e45f6bba0cab68bb984.elf