cc5e73ad5d32b85ff1a07c88ac022bc9ca9750b2c9ab9cb06a4a1f833b1408ea

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
18-08-2024 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x86
Size

55KB
MD5

30351d0f29fb5fd65c96894247d74fd9
SHA1

aa108a36a0368d3b1b7a489ab24f465cff77dd49
SHA256

cc5e73ad5d32b85ff1a07c88ac022bc9ca9750b2c9ab9cb06a4a1f833b1408ea
SHA512

12245656adb56d16239c5f7b8350002b8ea6dd00ec9c3895dfa242215c76a96c641df133278974dfa085fa3ad8f9d95617c035da8976fccadff2c5bcb3363803
SSDEEP

768:XEMDsWHerB0PQ+e86KvjQ5dIZALzkbdbyOaUalWMQs6xR334urC:ZDs20+Q+e86KvjiKYzoyOaUEWM1m3rC

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (23510) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Deletes itself 1 IoCs

Processes:

pid

2460
Enumerates running processes
Discovers information about currently running processes on the system
Changes its process name 1 IoCs

Processes:

description ioc pid

Changes the process name, possibly in an attempt to hide itself 2460

pid
2460

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself		2460

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

x86

description	ioc	process
File opened for reading	/proc/385/maps	x86
File opened for reading	/proc/2215/maps	x86
File opened for reading	/proc/2510/maps	x86
File opened for reading	/proc/80/exe	x86
File opened for reading	/proc/190/exe	x86
File opened for reading	/proc/198/maps	x86
File opened for reading	/proc/1915/maps	x86
File opened for reading	/proc/16/maps	x86
File opened for reading	/proc/189/exe	x86
File opened for reading	/proc/1872/maps	x86
File opened for reading	/proc/1332/maps	x86
File opened for reading	/proc/1678/maps	x86
File opened for reading	/proc/2265/maps	x86
File opened for reading	/proc/195/exe	x86
File opened for reading	/proc/712/maps	x86
File opened for reading	/proc/823/maps	x86
File opened for reading	/proc/192/maps	x86
File opened for reading	/proc/1745/maps	x86
File opened for reading	/proc/2206/maps	x86
File opened for reading	/proc/18/maps	x86
File opened for reading	/proc/42/exe	x86
File opened for reading	/proc/56/maps	x86
File opened for reading	/proc/49/exe	x86
File opened for reading	/proc/127/maps	x86
File opened for reading	/proc/759/maps	x86
File opened for reading	/proc/1940/maps	x86
File opened for reading	/proc/2457/maps	x86
File opened for reading	/proc/6/maps	x86
File opened for reading	/proc/10/exe	x86
File opened for reading	/proc/14/exe	x86
File opened for reading	/proc/2307/maps	x86
File opened for reading	/proc/26/exe	x86
File opened for reading	/proc/36/exe	x86
File opened for reading	/proc/768/maps	x86
File opened for reading	/proc/1389/maps	x86
File opened for reading	/proc/2472/maps	x86
File opened for reading	/proc/25/exe	x86
File opened for reading	/proc/38/exe	x86
File opened for reading	/proc/182/exe	x86
File opened for reading	/proc/439/maps	x86
File opened for reading	/proc/2456/maps	x86
File opened for reading	/proc/13/exe	x86
File opened for reading	/proc/34/maps	x86
File opened for reading	/proc/199/maps	x86
File opened for reading	/proc/33/maps	x86
File opened for reading	/proc/577/maps	x86
File opened for reading	/proc/744/maps	x86
File opened for reading	/proc/1902/maps	x86
File opened for reading	/proc/2455/exe	x86
File opened for reading	/proc/7/exe	x86
File opened for reading	/proc/18/exe	x86
File opened for reading	/proc/201/exe	x86
File opened for reading	/proc/42/maps	x86
File opened for reading	/proc/51/exe	x86
File opened for reading	/proc/195/maps	x86
File opened for reading	/proc/2456/exe	x86
File opened for reading	/proc/21/maps	x86
File opened for reading	/proc/24/maps	x86
File opened for reading	/proc/41/maps	x86
File opened for reading	/proc/191/maps	x86
File opened for reading	/proc/197/exe	x86
File opened for reading	/proc/1086/maps	x86
File opened for reading	/proc/2107/maps	x86
File opened for reading	/proc/16/exe	x86

/tmp/x86
/tmp/x86
1⤵
- Reads runtime system information
PID:2459

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads