Overview

overview

10

Static

static

10

b392483d5c...b1.elf

ubuntu-22.04-amd64

7

Analysis

  • max time kernel
    120s
  • max time network
    133s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    27-07-2024 01:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b392483d5c55d8618b8a921306a08eb1.elf

  • Size

    93KB

  • MD5

    b392483d5c55d8618b8a921306a08eb1

  • SHA1

    c4f582f62197b0046b15031b01d2d0164359c7b2

  • SHA256

    6d011b0cebea4188de630dad5a6fa8bdc61a3784b0958a07617eb6b94354e567

  • SHA512

    57be539f25d1bbb12bbbff2544fb370ebbd1ca58ce7c86b5ef39ac0488c1cda48c0f0dabd14a9d91b1350b5eb2ce2b38fb232d771d08483abfa1208214b15a8d

  • SSDEEP

    1536:dgGN1+S0EUf0S7iOxChSm6V1BToFGHGI9WzmaXY0KGrHisZi0Oz/LBDQHRP:eG+SLUcSmgCh16LBTo4HwbI0iYi0Oz/K

Score
7/10
evasion

Malware Config

Signatures

  • Deletes journal logs 1 TTPs 3 IoCs

    Deletes systemd journal logs. Likely to evade detection.

    evasion
  • Writes DNS configuration 1 TTPs 1 IoCs

    Writes data to DNS resolver config file.

  • Deletes log files 1 TTPs 62 IoCs

    Deletes log files on the system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Changes its process name 1 IoCs
  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/b392483d5c55d8618b8a921306a08eb1.elf
    /tmp/b392483d5c55d8618b8a921306a08eb1.elf
    1⤵
    • Writes DNS configuration
    • Changes its process name
    PID:1569
    • /bin/sh
      sh -c "pkill -9 busybox"
      2⤵
        PID:1584
        • /usr/bin/pkill
          pkill -9 busybox
          3⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1585
      • /bin/sh
        sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"
        2⤵
          PID:1598
          • /usr/bin/rm
            rm -rf /tmp/b392483d5c55d8618b8a921306a08eb1.elf /tmp/gdm3-config-err-Yzo6Ct /tmp/snap-private-tmp /tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-ModemManager.service-Dvt640 /tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-colord.service-ZhxDOd /tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-power-profiles-daemon.service-1WjcMq /tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-switcheroo-control.service-vEXzTF /tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-systemd-logind.service-1Cdrak /tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-systemd-oomd.service-I5zAsS /tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-systemd-resolved.service-Cx30u3 /tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-systemd-timedated.service-f8iiT8 /tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-upower.service-eaoiLp /var/backups /var/cache /var/crash /var/lib /var/local /var/lock /var/log /var/mail /var/metrics /var/opt /var/run /var/snap /var/spool /var/tmp /var/run/NetworkManager /var/run/acpid.pid /var/run/acpid.socket /var/run/agetty.reload /var/run/avahi-daemon /var/run/blkid /var/run/cloud-init /var/run/console-setup /var/run/credentials /var/run/crond.pid /var/run/crond.reboot /var/run/cryptsetup /var/run/cups /var/run/dbus /var/run/dmeventd-client /var/run/dmeventd-server /var/run/fsck /var/run/gdm3 /var/run/gdm3.pid /var/run/initctl /var/run/initramfs /var/run/lock /var/run/log /var/run/lvm /var/run/lxd-installer.socket /var/run/mount /var/run/multipath /var/run/multipathd.pid /var/run/openvpn /var/run/openvpn-client /var/run/openvpn-server /var/run/sendsigs.omit.d /var/run/shm /var/run/snapd-snap.socket /var/run/snapd.socket /var/run/speech-dispatcher /var/run/spice-vdagentd /var/run/sshd /var/run/sshd.pid /var/run/sudo /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/udisks2 /var/run/user /var/run/utmp /var/tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-ModemManager.service-7lyQ4q /var/tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-colord.service-MeoKHr /var/tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-power-profiles-daemon.service-60SszU /var/tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-switcheroo-control.service-Gld7uD /var/tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-systemd-logind.service-u4T68w /var/tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-systemd-oomd.service-0IqKbZ /var/tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-systemd-resolved.service-MftqAX /var/tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-systemd-timedated.service-7tAWeM /var/tmp/systemd-private-20b0b10133a747048c4c111c913ea85a-upower.service-pI5Xg1
            3⤵
            • Deletes journal logs
            • Deletes log files
            PID:1599
        • /bin/sh
          sh -c "rm -rf /var/log/wtmp"
          2⤵
            PID:1628
            • /usr/bin/rm
              rm -rf /var/log/wtmp
              3⤵
              • Deletes log files
              PID:1629
          • /bin/sh
            sh -c "rm -rf ~/.bash_history"
            2⤵
              PID:1630
              • /usr/bin/rm
                rm -rf "~/.bash_history"
                3⤵
                  PID:1631
              • /bin/sh
                sh -c "history -c;history -w"
                2⤵
                  PID:1632

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads