Analysis Overview
score
6/10
SHA256
c98bd40dc0d9198632e4b8ed945256b15e93d302ba1b667be69c63773b5d5e38
Threat Level: Shows suspicious behavior
The file b901090f16d480f12ac15e66d60c38ba.bin was found to be: Shows suspicious behavior.
Malicious Activity Summary
Enumerates running processes
Changes its process name
Reads runtime system information
MITRE ATT&CK
N/A
Analysis: static1
Detonation Overview
Reported
2024-06-07 02:50
Signatures
N/A
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-07 02:50
Reported
2024-06-07 02:56
Platform
ubuntu1804-amd64-20240508-en
Max time kernel
4s
Max time network
13s
Command Line
[/tmp/fac0971b56235030e059a55ccd229626115bed33c9205420876ab386a092a32e.elf]
Signatures
Enumerates running processes
Changes its process name
| Description | Indicator | Process | Target |
| Changes the process name, possibly in an attempt to hide itself | N/A | /tmp/fac0971b56235030e059a55ccd229626115bed33c9205420876ab386a092a32e.elf | N/A |
Reads runtime system information
Processes
/tmp/fac0971b56235030e059a55ccd229626115bed33c9205420876ab386a092a32e.elf
[/tmp/fac0971b56235030e059a55ccd229626115bed33c9205420876ab386a092a32e.elf]
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | cnc.buthost.pl | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | cnc.buthost.pl | udp |
| US | 8.8.8.8:53 | cnc.buthost.pl | udp |
| US | 8.8.8.8:53 | cnc.buthost.pl | udp |
| US | 8.8.8.8:53 | cnc.buthost.pl | udp |
| US | 151.101.129.91:443 | tcp | |
| GB | 195.181.164.16:443 | tcp | |
| US | 8.8.8.8:53 | cnc.buthost.pl | udp |
| US | 8.8.8.8:53 | cnc.buthost.pl | udp |
| US | 8.8.8.8:53 | cnc.buthost.pl | udp |
| US | 8.8.8.8:53 | cnc.buthost.pl | udp |
| US | 8.8.8.8:53 | cnc.buthost.pl | udp |
| GB | 185.125.188.61:443 | tcp | |
| GB | 185.125.188.61:443 | tcp | |
| US | 8.8.8.8:53 | cnc.buthost.pl | udp |
| US | 8.8.8.8:53 | cnc.buthost.pl | udp |
| US | 8.8.8.8:53 | cnc.buthost.pl | udp |
| US | 8.8.8.8:53 | cnc.buthost.pl | udp |
| US | 8.8.8.8:53 | cnc.buthost.pl | udp |
| US | 1.1.1.1:53 | extensions.gnome.org | udp |
| US | 1.1.1.1:53 | extensions.gnome.org | udp |
| US | 151.101.193.91:443 | extensions.gnome.org | tcp |
| US | 1.1.1.1:53 | 1527653184.rsc.cdn77.org | udp |
| US | 1.1.1.1:53 | 1527653184.rsc.cdn77.org | udp |
| GB | 195.181.164.15:443 | 1527653184.rsc.cdn77.org | tcp |
Files
N/A