Resubmissions
13/07/2024, 02:51
240713-dcketasekn1013/07/2024, 02:49
240713-da59havdnh1013/07/2024, 02:48
240713-daplravdlh1020/01/2022, 07:00
220120-hspfxsgfd510Analysis
- max time kernel
120s - max time network
117s - platform
ubuntu-22.04_amd64 - resource
ubuntu2204-amd64-20240611-en - resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system - submitted
13/07/2024, 02:49
Behavioral task
behavioral1
Sample
Josho.x86
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
6 signatures
600 seconds
General
- Target Josho.x86
- Size 40KB
- Sample240713-da59havdnh
- SHA256 50f798eb3aadfd6966a479b74dff730bc03901ca78792f77e570ee5393f45c51
- MD5 d3bcd7d304ca56b6f685073ae65fd399
- SHA1 ce33c18115e73f32e83c693cf51b8b2aa201e886
- SHA512 9275e05e918712eb0b82b7776f61eb8bb32eb8fe316f85f2fe8082fd5fa36a4199b0e78358eb031fedea0354f6bc15dc809154e9632d983b1884a15b50fd1612
- SSDEEP 768:Ms1yfBjf74x6DhdZMddQmJTy5GgOegYEu0ploF4M4Kj9nK:py5jf74x6DB8mmJTyXgY4ploFX4KjB
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Josho.x86 File opened for modification /dev/misc/watchdog Josho.x86 - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp Josho.x86 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1566 Josho.x86 - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp Josho.x86 - Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/980/fd Josho.x86 File opened for reading /proc/1013/fd Josho.x86 File opened for reading /proc/1142/fd Josho.x86 File opened for reading /proc/1159/fd Josho.x86 File opened for reading /proc/1161/fd Josho.x86 File opened for reading /proc/1107/fd Josho.x86 File opened for reading /proc/1570/fd Josho.x86 File opened for reading /proc/665/fd Josho.x86 File opened for reading /proc/742/fd Josho.x86 File opened for reading /proc/1077/fd Josho.x86 File opened for reading /proc/1166/fd Josho.x86 File opened for reading /proc/1204/fd Josho.x86 File opened for reading /proc/1377/fd Josho.x86 File opened for reading /proc/1439/fd Josho.x86 File opened for reading /proc/377/fd Josho.x86 File opened for reading /proc/972/fd Josho.x86 File opened for reading /proc/1038/fd Josho.x86 File opened for reading /proc/1158/fd Josho.x86 File opened for reading /proc/1569/fd Josho.x86 File opened for reading /proc/635/fd Josho.x86 File opened for reading /proc/716/fd Josho.x86 File opened for reading /proc/1167/fd Josho.x86 File opened for reading /proc/1248/fd Josho.x86 File opened for reading /proc/610/fd Josho.x86 File opened for reading /proc/1280/fd Josho.x86 File opened for reading /proc/1507/fd Josho.x86 File opened for reading /proc/636/fd Josho.x86 File opened for reading /proc/1163/fd Josho.x86 File opened for reading /proc/1197/fd Josho.x86 File opened for reading /proc/454/fd Josho.x86 File opened for reading /proc/641/fd Josho.x86 File opened for reading /proc/1054/fd Josho.x86 File opened for reading /proc/1062/fd Josho.x86 File opened for reading /proc/756/fd Josho.x86 File opened for reading /proc/771/fd Josho.x86 File opened for reading /proc/1344/fd Josho.x86 File opened for reading /proc/837/fd Josho.x86 File opened for reading /proc/1114/fd Josho.x86 File opened for reading /proc/746/fd Josho.x86 File opened for reading /proc/870/fd Josho.x86 File opened for reading /proc/1254/fd Josho.x86 File opened for reading /proc/781/fd Josho.x86 File opened for reading /proc/1033/fd Josho.x86 File opened for reading /proc/614/fd Josho.x86 File opened for reading /proc/866/fd Josho.x86 File opened for reading /proc/1567/exe Josho.x86 File opened for reading /proc/426/fd Josho.x86 File opened for reading /proc/590/fd Josho.x86 File opened for reading /proc/747/fd Josho.x86 File opened for reading /proc/1098/fd Josho.x86 File opened for reading /proc/1434/fd Josho.x86 File opened for reading /proc/1126/fd Josho.x86 File opened for reading /proc/1276/fd Josho.x86 File opened for reading /proc/1452/fd Josho.x86 File opened for reading /proc/1165/fd Josho.x86 File opened for reading /proc/1238/fd Josho.x86 File opened for reading /proc/1487/fd Josho.x86 File opened for reading /proc/1146/fd Josho.x86 File opened for reading /proc/1290/fd Josho.x86 File opened for reading /proc/634/fd Josho.x86 File opened for reading /proc/1088/fd Josho.x86 File opened for reading /proc/738/fd Josho.x86 File opened for reading /proc/991/fd Josho.x86 File opened for reading /proc/1372/fd Josho.x86