28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6

General

Target

28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
Size

156KB
MD5

9f06e0d941dd9632ca4d0a8bcb9420fb
SHA1

89abd86d7558738abdcea7db06133c0396d53318
SHA256

28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6
SHA512

f6389e513bef40f3a445f246b4cc3058b36a9aea3d5bd9154502a0cfa501e0d0488fdc42fbcde9ec6a07cfa85fba5a99bd5d00e24f217c89e57d115096004239
SSDEEP

3072:B2hKj/Y1SX1Qq/TK/Sss/na6qUmT/+RuPlnDlHGamkvrmp5UP0q:B2hKj/Y1SX17TK/l/pkoP0q

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (79708) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

Processes:

28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	)5+	1587	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf

description	ioc	process
File opened for reading	/proc/98/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/778/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1272/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1328/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/74/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/409/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1176/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/5/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/838/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1597/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/11/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/109/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1408/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/212/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/753/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1171/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1471/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/446/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1152/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1203/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/22/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/222/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/373/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/218/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1070/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1186/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/78/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/602/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1050/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/8/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/216/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1030/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/521/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/644/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1010/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1073/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1461/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/12/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/91/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/101/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1138/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1158/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/582/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/599/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/987/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/113/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/210/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1590/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/73/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1200/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1394/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1560/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/96/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/215/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/224/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/840/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1154/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1574/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/745/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/1166/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/80/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/94/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/632/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
File opened for reading	/proc/25/cmdline	28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf

/tmp/28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
/tmp/28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
1⤵
- Changes its process name
- Reads runtime system information
PID:1587

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads