Overview

overview

9

Static

static

1

ddf1ed808d...16.elf

ubuntu-24.04-amd64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    ddf1ed808d8b26b1378ebd42dacadb1250b112f44ebd728e9305d914d56e6b16.elf

  • Size

    152KB

  • Sample

    240803-ctrpsazenm

  • MD5

    5de9690d4cc93a329a2fe5d5392e1457

  • SHA1

    11b0f37e1249f9dabecbf5cd7163bddf709885cc

  • SHA256

    ddf1ed808d8b26b1378ebd42dacadb1250b112f44ebd728e9305d914d56e6b16

  • SHA512

    2055842fa66e635fcec57cb67ed4401b4005c1831c68d6874645b46a25568cb315a538abd2be54f06fdcfa4986f4232af33d22a3db05ca02c0d67aff71769b09

  • SSDEEP

    3072:BE7DjyBcD3KOvbIbA23DVkUDJUEoCWUoVYORenBkT8YfBN/3XWgXo:BE7DjyBcD3KOUA25YYYFvFfB8gXo

Score
9/10
discoverylinux

Malware Config

Targets

    • Target

      ddf1ed808d8b26b1378ebd42dacadb1250b112f44ebd728e9305d914d56e6b16.elf

    • Size

      152KB

    • MD5

      5de9690d4cc93a329a2fe5d5392e1457

    • SHA1

      11b0f37e1249f9dabecbf5cd7163bddf709885cc

    • SHA256

      ddf1ed808d8b26b1378ebd42dacadb1250b112f44ebd728e9305d914d56e6b16

    • SHA512

      2055842fa66e635fcec57cb67ed4401b4005c1831c68d6874645b46a25568cb315a538abd2be54f06fdcfa4986f4232af33d22a3db05ca02c0d67aff71769b09

    • SSDEEP

      3072:BE7DjyBcD3KOvbIbA23DVkUDJUEoCWUoVYORenBkT8YfBN/3XWgXo:BE7DjyBcD3KOUA25YYYFvFfB8gXo

    Score
    9/10
    discovery

    • Contacts a large (233545) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Writes file to system bin folder

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks