Resubmissions
13/07/2024, 02:51
240713-dcketasekn1013/07/2024, 02:49
240713-da59havdnh1013/07/2024, 02:48
240713-daplravdlh1020/01/2022, 07:00
220120-hspfxsgfd510Analysis
- max time kernel
104s - max time network
103s - platform
ubuntu-20.04_amd64 - resource
ubuntu2004-amd64-20240508-en - resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system - submitted
13/07/2024, 02:51
Behavioral task
behavioral1
Sample
Josho.x86
Resource
ubuntu2004-amd64-20240508-en
ubuntu-20.04-amd64
6 signatures
600 seconds
Behavioral task
behavioral2
Sample
Josho.x86
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
2 signatures
600 seconds
General
- Target Josho.x86
- Size 40KB
- Sample240713-dcketasekn
- SHA256 50f798eb3aadfd6966a479b74dff730bc03901ca78792f77e570ee5393f45c51
- MD5 d3bcd7d304ca56b6f685073ae65fd399
- SHA1 ce33c18115e73f32e83c693cf51b8b2aa201e886
- SHA512 9275e05e918712eb0b82b7776f61eb8bb32eb8fe316f85f2fe8082fd5fa36a4199b0e78358eb031fedea0354f6bc15dc809154e9632d983b1884a15b50fd1612
- SSDEEP 768:Ms1yfBjf74x6DhdZMddQmJTy5GgOegYEu0ploF4M4Kj9nK:py5jf74x6DB8mmJTyXgY4ploFX4KjB
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Josho.x86 File opened for modification /dev/misc/watchdog Josho.x86 - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp Josho.x86 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1403 Josho.x86 - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp Josho.x86 - Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/696/fd Josho.x86 File opened for reading /proc/901/fd Josho.x86 File opened for reading /proc/1326/fd Josho.x86 File opened for reading /proc/1407/exe Josho.x86 File opened for reading /proc/649/fd Josho.x86 File opened for reading /proc/652/fd Josho.x86 File opened for reading /proc/786/fd Josho.x86 File opened for reading /proc/911/fd Josho.x86 File opened for reading /proc/984/fd Josho.x86 File opened for reading /proc/1099/fd Josho.x86 File opened for reading /proc/1404/fd Josho.x86 File opened for reading /proc/811/fd Josho.x86 File opened for reading /proc/999/fd Josho.x86 File opened for reading /proc/1079/fd Josho.x86 File opened for reading /proc/1117/fd Josho.x86 File opened for reading /proc/590/fd Josho.x86 File opened for reading /proc/671/fd Josho.x86 File opened for reading /proc/1088/fd Josho.x86 File opened for reading /proc/1108/fd Josho.x86 File opened for reading /proc/499/fd Josho.x86 File opened for reading /proc/1067/fd Josho.x86 File opened for reading /proc/1107/fd Josho.x86 File opened for reading /proc/489/fd Josho.x86 File opened for reading /proc/951/fd Josho.x86 File opened for reading /proc/1036/fd Josho.x86 File opened for reading /proc/1057/fd Josho.x86 File opened for reading /proc/1076/fd Josho.x86 File opened for reading /proc/1159/fd Josho.x86 File opened for reading /proc/459/fd Josho.x86 File opened for reading /proc/1092/fd Josho.x86 File opened for reading /proc/1404/exe Josho.x86 File opened for reading /proc/443/fd Josho.x86 File opened for reading /proc/650/fd Josho.x86 File opened for reading /proc/908/fd Josho.x86 File opened for reading /proc/616/fd Josho.x86 File opened for reading /proc/1031/fd Josho.x86 File opened for reading /proc/454/fd Josho.x86 File opened for reading /proc/458/fd Josho.x86 File opened for reading /proc/914/fd Josho.x86 File opened for reading /proc/946/fd Josho.x86 File opened for reading /proc/1125/fd Josho.x86 File opened for reading /proc/621/fd Josho.x86 File opened for reading /proc/457/fd Josho.x86 File opened for reading /proc/500/fd Josho.x86 File opened for reading /proc/508/fd Josho.x86 File opened for reading /proc/576/fd Josho.x86 File opened for reading /proc/1081/fd Josho.x86 File opened for reading /proc/486/fd Josho.x86 File opened for reading /proc/1085/fd Josho.x86 File opened for reading /proc/1406/fd Josho.x86 File opened for reading /proc/970/fd Josho.x86 File opened for reading /proc/1077/fd Josho.x86 File opened for reading /proc/1112/fd Josho.x86 File opened for reading /proc/1176/fd Josho.x86 File opened for reading /proc/396/fd Josho.x86 File opened for reading /proc/796/fd Josho.x86 File opened for reading /proc/1078/fd Josho.x86 File opened for reading /proc/1135/fd Josho.x86 File opened for reading /proc/243/fd Josho.x86 File opened for reading /proc/692/fd Josho.x86 File opened for reading /proc/975/fd Josho.x86 File opened for reading /proc/583/fd Josho.x86 File opened for reading /proc/962/fd Josho.x86 File opened for reading /proc/994/fd Josho.x86