Analysis
-
max time kernel
1s -
max time network
129s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
01-07-2024 02:51
Static task
static1
Behavioral task
behavioral1
Sample
28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
Resource
ubuntu2204-amd64-20240611-en
General
-
Target
28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf
-
Size
156KB
-
MD5
9f06e0d941dd9632ca4d0a8bcb9420fb
-
SHA1
89abd86d7558738abdcea7db06133c0396d53318
-
SHA256
28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6
-
SHA512
f6389e513bef40f3a445f246b4cc3058b36a9aea3d5bd9154502a0cfa501e0d0488fdc42fbcde9ec6a07cfa85fba5a99bd5d00e24f217c89e57d115096004239
-
SSDEEP
3072:B2hKj/Y1SX1Qq/TK/Sss/na6qUmT/+RuPlnDlHGamkvrmp5UP0q:B2hKj/Y1SX17TK/l/pkoP0q
Malware Config
Signatures
-
Contacts a large (23440) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
Processes:
28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself )5+ 1587 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elfdescription ioc process File opened for reading /proc/77/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/413/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/959/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1129/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1590/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/11/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/987/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1321/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/210/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/212/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/498/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/23/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/693/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/745/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/223/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1199/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1338/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/222/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1407/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/645/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/772/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1107/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1157/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/95/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/213/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/631/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/6/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/162/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/590/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/25/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/405/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/118/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/311/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/669/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1169/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1170/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/73/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/738/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/777/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1160/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1329/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/216/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/754/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/767/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/96/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/779/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1035/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/92/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/83/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1050/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1268/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1156/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1577/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/18/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/75/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/734/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/2/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/81/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/15/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/99/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/399/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/112/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1111/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf File opened for reading /proc/1159/cmdline 28b636dd861a4f2ba6ef2228e31b1cf314e503e8c052fa02c1b5aaf8a1c779f6.elf