Analysis
-
max time kernel
147s -
max time network
149s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
15-05-2024 02:22
Static task
static1
Behavioral task
behavioral1
Sample
3cb2272e9a121654edd2b7338c66d591.bin
Resource
ubuntu2004-amd64-20240508-en
ubuntu-20.04-amd64
3 signatures
150 seconds
General
-
Target
3cb2272e9a121654edd2b7338c66d591.bin
-
Size
86KB
-
MD5
3cb2272e9a121654edd2b7338c66d591
-
SHA1
1fa194a12de67b7f83b1349246b504b31d0ef12b
-
SHA256
0ce5bdeadb6d824061af3751e61b54577f4430d1985b3dce38b6a4081ad59fe9
-
SHA512
44e7783f4599f7d3716cd909eb3c8dae86786bedd36be4bcdede20dbab89743e521b49329b254f9b211fc08fb38e5891e3547273084fe4162a871e7e65133082
-
SSDEEP
1536:qvu1gtrMtjWqtgI6kev6mJgyPyp6z7m4fkr6iLHzEC5wOHkIpHqJRU:qW1gHqWLDv6gPyu7zCDLHzE2wOEIp
Score
6/10
Malware Config
Signatures
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
Processes:
3cb2272e9a121654edd2b7338c66d591.bindescription ioc process File opened for reading /proc/net/route 3cb2272e9a121654edd2b7338c66d591.bin -
Changes its process name 1 IoCs
Processes:
3cb2272e9a121654edd2b7338c66d591.bindescription ioc pid process Changes the process name, possibly in an attempt to hide itself /usr/sbin/dropbear 1442 3cb2272e9a121654edd2b7338c66d591.bin -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
3cb2272e9a121654edd2b7338c66d591.bindescription ioc process File opened for reading /proc/net/route 3cb2272e9a121654edd2b7338c66d591.bin