Overview

overview

7

Static

static

7

9ef2ef0237...61.elf

ubuntu-20.04-amd64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ef2ef02376445bf4c145820c0c81f2bbe0b96f2017278562e0bd259bf7bd061.elf

  • Size

    1.6MB

  • Sample

    240614-hn97tsygrg

  • MD5

    5d48c415e18f49f27e5e038ad59f5997

  • SHA1

    61447991965ddae6159dc993987c5b9329a8e101

  • SHA256

    9ef2ef02376445bf4c145820c0c81f2bbe0b96f2017278562e0bd259bf7bd061

  • SHA512

    9e7f90f0eba310b82440006d9991bc9b2275f07f579a1b783b1df2b7ef029e902eccad3a40adeeb8a71e19887622ba4a12aeeef70c98f81947ec8a93fe988f62

  • SSDEEP

    49152:3VG50GdIkmL0gmVQeQriZ+xATnDB8cCENV:3oqkmQgmVG/aXacCENV

Score
7/10
antivmlinuxpersistenceupx

Malware Config

Targets

    • Target

      9ef2ef02376445bf4c145820c0c81f2bbe0b96f2017278562e0bd259bf7bd061.elf

    • Size

      1.6MB

    • MD5

      5d48c415e18f49f27e5e038ad59f5997

    • SHA1

      61447991965ddae6159dc993987c5b9329a8e101

    • SHA256

      9ef2ef02376445bf4c145820c0c81f2bbe0b96f2017278562e0bd259bf7bd061

    • SHA512

      9e7f90f0eba310b82440006d9991bc9b2275f07f579a1b783b1df2b7ef029e902eccad3a40adeeb8a71e19887622ba4a12aeeef70c98f81947ec8a93fe988f62

    • SSDEEP

      49152:3VG50GdIkmL0gmVQeQriZ+xATnDB8cCENV:3oqkmQgmVG/aXacCENV

    Score
    6/10
    antivmpersistence

    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

      antivm

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks