Analysis
-
max time kernel
149s -
max time network
149s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
02-08-2024 14:10
Behavioral task
behavioral1
Sample
0af64d9597f499563abbeeeb8e2e1ad1.elf
Resource
ubuntu2204-amd64-20240522.1-en
ubuntu-22.04-amd64
3 signatures
150 seconds
General
-
Target
0af64d9597f499563abbeeeb8e2e1ad1.elf
-
Size
136KB
-
MD5
0af64d9597f499563abbeeeb8e2e1ad1
-
SHA1
be42241dfbfa3691419b2f8ca63e1aff28366565
-
SHA256
cc2564ca195391f08b42f023a7255f0367048899e11825863dd2fd7a348f9038
-
SHA512
d862490819a101185dd556559d84484f5e69afe15e10009e4f8852819711438820e57cd668a872ecf6fcc17d9519e5fdef0bdb7478e872f61d6f0be75496b321
-
SSDEEP
3072:tGtwnNiaOnUTNFiPT9OSQ7AOaogjV2iZlBWCgxiALQPdL:tGtwnNiaOnUTTuLy7LQPd
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 1554 0af64d9597f499563abbeeeb8e2e1ad1.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/679/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/963/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1068/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1207/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1315/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/204/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1175/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/639/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/520/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/23/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/749/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/80/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/633/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1552/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/102/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/10/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/634/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1126/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1219/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/2/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/101/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/741/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1160/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1236/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1403/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/93/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/498/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1166/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/24/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/413/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/523/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/611/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/723/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/957/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1178/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1180/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/86/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/98/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/217/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/426/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/761/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1378/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/11/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/821/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/839/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/221/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1172/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1206/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1245/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/83/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1557/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1038/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/113/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/164/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/25/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/163/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1360/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/97/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1057/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/872/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/640/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/1033/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/9/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf File opened for reading /proc/78/cmdline 0af64d9597f499563abbeeeb8e2e1ad1.elf