Analysis
-
max time kernel
1s -
max time network
128s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240418-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240418-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
07/05/2024, 01:09
Static task
static1
Behavioral task
behavioral1
Sample
1f170141be3baceaf4ba1f2281644894588da2ed02a2f5a75ab32d49da644dec.elf
Resource
ubuntu1804-amd64-20240418-en
1 signatures
150 seconds
General
-
Target
1f170141be3baceaf4ba1f2281644894588da2ed02a2f5a75ab32d49da644dec.elf
-
Size
51KB
-
MD5
3a09a74cf6c47d69f025c205fde89bc9
-
SHA1
eb30a48246a86f39f0038ebf116a53a45dc3bf1a
-
SHA256
1f170141be3baceaf4ba1f2281644894588da2ed02a2f5a75ab32d49da644dec
-
SHA512
4e3b9984d537c8c8bbb674fab7b733ee42cd5c4659a1efe978f6164cff3323a421d4a17bde64706b572cdc7c9baa05b5303c32842dbbc69dfaf80cfc0bd64e12
-
SSDEEP
768:NgplhD19+0yAuhIlCmBRP0IuYebtkaBLtR40Nj5UEr:ijxyUCmBRzL0JtZNjZr
Score
3/10
Malware Config
Signatures
-
Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/1544/exe 1f170141be3baceaf4ba1f2281644894588da2ed02a2f5a75ab32d49da644dec.elf File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mv
Processes
-
/tmp/1f170141be3baceaf4ba1f2281644894588da2ed02a2f5a75ab32d49da644dec.elf/tmp/1f170141be3baceaf4ba1f2281644894588da2ed02a2f5a75ab32d49da644dec.elf1⤵
- Reads runtime system information
PID:1542 -
/bin/shsh -c "mkdir /9rftscavtz/ && >/9rftscavtz/9rftscavtz && cd /9rftscavtz/ >/dev/null"2⤵PID:1545
-
/bin/mkdirmkdir /9rftscavtz/3⤵
- Reads runtime system information
PID:1546
-
-
-
/bin/shsh -c "mv /tmp/1f170141be3baceaf4ba1f2281644894588da2ed02a2f5a75ab32d49da644dec.elf /9rftscavtz/9rftscavtz && chmod 777 /9rftscavtz/9rftscavtz >/dev/null"2⤵PID:1547
-
/bin/mvmv /tmp/1f170141be3baceaf4ba1f2281644894588da2ed02a2f5a75ab32d49da644dec.elf /9rftscavtz/9rftscavtz3⤵
- Reads runtime system information
PID:1548
-
-
/bin/chmodchmod 777 /9rftscavtz/9rftscavtz3⤵PID:1549
-
-