3b7e69fb314ffdeb13c36e9ecf20a9476f34374c30ce437dea4e0db193ceb1d8

Analysis

max time kernel
149s
max time network
131s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22-05-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b7e69fb314ffdeb13c36e9ecf20a9476f34374c30ce437dea4e0db193ceb1d8.elf
Size

60KB
MD5

1fa6befa83300967bbd31b7aa745f972
SHA1

8a09dc37d02796146b40e336c7a9c9c5ebba4e8b
SHA256

3b7e69fb314ffdeb13c36e9ecf20a9476f34374c30ce437dea4e0db193ceb1d8
SHA512

a90fb7b23ae9087db504b1778b1bbbca16b147e5cf68646045f710032a8cf5fb92561525fd8df41b0584de83313bc099711f3f4081d781be713031ef8b6dfb41
SSDEEP

1536:W/4vP/fDv1Y7GuNNq4vMSvglokUx3108OFfGPw/62cHBwr:Aa71Y7GuK4vn3+E9HO

Score

7^/10

antivm

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

3b7e69fb314ffdeb13c36e9ecf20a9476f34374c30ce437dea4e0db193ceb1d8.elf

pid process

1474 3b7e69fb314ffdeb13c36e9ecf20a9476f34374c30ce437dea4e0db193ceb1d8.elf

pid	process
1474	3b7e69fb314ffdeb13c36e9ecf20a9476f34374c30ce437dea4e0db193ceb1d8.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

3b7e69fb314ffdeb13c36e9ecf20a9476f34374c30ce437dea4e0db193ceb1d8.elf

description	ioc	process
File opened for modification	/dev/watchdog	3b7e69fb314ffdeb13c36e9ecf20a9476f34374c30ce437dea4e0db193ceb1d8.elf
File opened for modification	/dev/misc/watchdog	3b7e69fb314ffdeb13c36e9ecf20a9476f34374c30ce437dea4e0db193ceb1d8.elf

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 2 IoCs

Processes:

3b7e69fb314ffdeb13c36e9ecf20a9476f34374c30ce437dea4e0db193ceb1d8.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	telnetd	1474	3b7e69fb314ffdeb13c36e9ecf20a9476f34374c30ce437dea4e0db193ceb1d8.elf
Changes the process name, possibly in an attempt to hide itself	telnetd	1475

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

3b7e69fb314ffdeb13c36e9ecf20a9476f34374c30ce437dea4e0db193ceb1d8.elf

description ioc process

File opened for reading /proc/cpuinfo 3b7e69fb314ffdeb13c36e9ecf20a9476f34374c30ce437dea4e0db193ceb1d8.elf
Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery
T1082

Processes:

ps

description ioc process

File opened for reading /sys/devices/system/cpu/online ps

description	ioc	process
File opened for reading	/proc/cpuinfo	3b7e69fb314ffdeb13c36e9ecf20a9476f34374c30ce437dea4e0db193ceb1d8.elf

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc	process
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/177/stat	ps
File opened for reading	/proc/586/status	ps
File opened for reading	/proc/657/status	ps
File opened for reading	/proc/167/stat	ps
File opened for reading	/proc/1107/status	ps
File opened for reading	/proc/1470/status	ps
File opened for reading	/proc/1332/stat	ps
File opened for reading	/proc/30/stat	ps
File opened for reading	/proc/31/status	ps
File opened for reading	/proc/130/status	ps
File opened for reading	/proc/172/status	ps
File opened for reading	/proc/499/status	ps
File opened for reading	/proc/1483/stat	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/81/stat	ps
File opened for reading	/proc/441/stat	ps
File opened for reading	/proc/464/stat	ps
File opened for reading	/proc/956/status	ps
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/701/stat	ps
File opened for reading	/proc/1163/status	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/98/status	ps
File opened for reading	/proc/484/stat	ps
File opened for reading	/proc/605/status	ps
File opened for reading	/proc/707/stat	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/35/status	ps
File opened for reading	/proc/89/status	ps
File opened for reading	/proc/170/stat	ps
File opened for reading	/proc/496/stat	ps
File opened for reading	/proc/691/stat	ps
File opened for reading	/proc/1111/status	ps
File opened for reading	/proc/1481/stat	ps
File opened for reading	/proc/104/stat	ps
File opened for reading	/proc/169/status	ps
File opened for reading	/proc/499/stat	ps
File opened for reading	/proc/554/status	ps
File opened for reading	/proc/570/status	ps
File opened for reading	/proc/1259/status	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/80/status	ps
File opened for reading	/proc/207/status	ps
File opened for reading	/proc/1025/status	ps
File opened for reading	/proc/1130/stat	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/655/stat	ps
File opened for reading	/proc/655/status	ps
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/165/stat	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/1090/status	ps
File opened for reading	/proc/1478/stat	ps
File opened for reading	/proc/586/stat	ps
File opened for reading	/proc/1244/status	ps
File opened for reading	/proc/1289/status	ps
File opened for reading	/proc/6/status	ps
File opened for reading	/proc/26/status	ps
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/78/stat	ps
File opened for reading	/proc/567/stat	ps
File opened for reading	/proc/1483/status	ps

/tmp/3b7e69fb314ffdeb13c36e9ecf20a9476f34374c30ce437dea4e0db193ceb1d8.elf
/tmp/3b7e69fb314ffdeb13c36e9ecf20a9476f34374c30ce437dea4e0db193ceb1d8.elf
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Changes its process name
- Checks CPU configuration
PID:1474

/bin/sh
sh -c "ps -eo pid,tty | grep -E 'pts|tty' | awk '{print \$1}'"
2⤵
PID:1480

/bin/ps
ps -eo "pid,tty"
3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1481

/bin/grep
grep -E "pts|tty"
3⤵
PID:1482

/usr/bin/awk
awk "{print \$1}"
3⤵
PID:1483

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads