fe2600532dabcfe55555d27a86184d9565bbd4fe047c960245993ca45f39285b

General

Target

143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
Size

146KB
MD5

dcb0dc8287e78f2bda47f5b19b1f08ac
SHA1

1bfcaeb52e8f333393b80133a7a247c9e65d02cc
SHA256

143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a
SHA512

6ab05e769159cce065fc0faab2bdf5316376d7c8b703beef4809939a6349dae2e65a29f14c95fdd34c5f40b312a191a2a7e3a72af772af443afc023118f8c367
SSDEEP

3072:d4p2xNQux8uSA1rf1qQ4xG1+q6A1WSo8physp:d4cjr1DEQ4xu+q63SRhyO

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (63213) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

Processes:

143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	)5+	646	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf

description	ioc	process
File opened for reading	/proc/735/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/24/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/41/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/639/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/668/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/676/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/724/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/733/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/713/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/6/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/27/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/212/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/643/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/692/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/698/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/707/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/662/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/704/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/738/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/2/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/10/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/107/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/703/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/708/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/726/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/729/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/12/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/394/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/661/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/714/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/720/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/728/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/716/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/106/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/168/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/296/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/636/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/659/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/666/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/702/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/723/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/599/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/306/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/457/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/650/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/652/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/677/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/725/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/730/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/279/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/671/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/737/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/4/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/104/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/146/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/653/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/712/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/701/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/5/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/26/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/139/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/280/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/663/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
File opened for reading	/proc/672/cmdline	143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf

/tmp/143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
/tmp/143e65a125e9aadbbe352773c24d049adb07c9ec1c9151f70f0dfc53131f860a.elf
1⤵
- Changes its process name
- Reads runtime system information
PID:646

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads