cee25cc5b9582224d6bc20580fbfb9aecc21efbf673719d378172cb0756e5415

Analysis

max time kernel
149s
max time network
153s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
10-08-2024 19:23

Target

SecuriteInfo.com.Linux.Siggen.9999.23304.26027.elf
Size

61KB
MD5

df62d3d53d3f634aae4a37df11acd1ed
SHA1

e5af5f52fe71317deda7e266b5c1d4d1610f34da
SHA256

cee25cc5b9582224d6bc20580fbfb9aecc21efbf673719d378172cb0756e5415
SHA512

911c64d707198f72e72770d4f1b303235befcdcbb72bdf5fb436a06dc9f9484cb45fda47dbc1242184c3108af653fc23b7b3afa858ff0b6db23024d98960ae30
SSDEEP

1536:2J5ivXfltjxvStba8IluvBhcZxb5l9CSNBODDF:2J5iXjjxvuba8I5P5ODDF

Score

7^/10

rootkit

Loads a kernel module 64 IoCs

Loads a Linux kernel module, potentially to achieve persistence

Processes:

SecuriteInfo.com.Linux.Siggen.9999.23304.26027.elf

pid	process
2481	SecuriteInfo.com.Linux.Siggen.9999.23304.26027.elf
2483
2482
2482
2483
2483
2482
2482
2482
2483
2483
2482
2482
2482
2483
2483
2482
2482
2482
2483
2483
2482
2482
2482
2483
2483
2482
2482
2482
2483
2483
2482
2483
2483
2482
2482
2482
2483
2483
2482
2482
2482
2483
2483
2482
2482
2482
2483
2483
2482
2482
2482
2483
2483
2482
2482
2482
2483
2483
2482
2482
2482
2483
2483

/tmp/SecuriteInfo.com.Linux.Siggen.9999.23304.26027.elf
/tmp/SecuriteInfo.com.Linux.Siggen.9999.23304.26027.elf
1⤵
- Loads a kernel module
PID:2481