ef2f1dc417409f24a18c8ffd8aa66b13c8bad51c30f7f382a9fd09c45f3bc9ed

General

Target

3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
Size

197KB
MD5

35812a25464519911cb11ffd65ab66fa
SHA1

62e977d27b4957189df2fdd998a6c12a360bd740
SHA256

3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329
SHA512

967045517e6df6ea01b65f45c168e12db23fedcface108a095e2403aeded5899a7221b65f09444af1e3ec755482e76456267c9702e07ae11c0038a83037f50d5
SSDEEP

3072:+Ghqh0S39eye3IRqhgjUo5p9Chw2l7oLcsKGz:+Go0Ss3bhgjUmp9gx7oQB

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (64937) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

Processes:

3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	)5+	717	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf

description	ioc	process
File opened for reading	/proc/37/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/337/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/5/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/127/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/678/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/336/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/679/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/699/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/712/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/715/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/7/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/8/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/15/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/126/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/78/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/237/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/342/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/675/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/713/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/721/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/11/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/17/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/24/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/718/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/720/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/19/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/82/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/176/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/77/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/343/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/383/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/390/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/716/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/6/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/16/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/72/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/719/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/2/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/14/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/110/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/18/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/36/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/723/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/4/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/21/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/23/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/159/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/722/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/12/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/20/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/71/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/384/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/442/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/10/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/73/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/253/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/9/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/153/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/672/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/22/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/70/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/76/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/67/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
File opened for reading	/proc/75/cmdline	3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf

/tmp/3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
/tmp/3c68788ddf6aae2c2a4cbdaa219e264aaada35d10a0edd21a13972d49aa12329.elf
1⤵
- Changes its process name
- Reads runtime system information
PID:717

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads