Analysis
-
max time kernel
145s -
max time network
129s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
30-08-2024 17:58
Static task
static1
Behavioral task
behavioral1
Sample
exe2
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
exe2
Resource
ubuntu2004-amd64-20240611-en
Behavioral task
behavioral3
Sample
exe2
Resource
ubuntu2204-amd64-20240729-en
General
-
Target
exe2
-
Size
7.8MB
-
MD5
0a2f3c43b33dedc9ce4144125a21edb6
-
SHA1
114a54c77385e6a06dcc88a522dcf80a0533d748
-
SHA256
15dc859276438bb55a1bcbf226b4b6b18b471c0f2fcee8a68e953da61af12d8f
-
SHA512
e45c7587cd18e765cff7776c8391586125315b98a979a99077337045dcc86522ec1e7cd52c33d6c973b0578c6207feeb1ed884e7dbc222a96daf71ef22edc09b
-
SSDEEP
49152:lLOIKx9eGrb/TSvO90dL3BmAFd4A64nsfJos81upTcr7fWg25g1tGoLNF8/be4Y8:lLH/tLJ2Q7fOrtTNUls0tQiLvE
Malware Config
Signatures
-
Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/class/dmi/id/product_uuid exe2 -
Reads list of loaded kernel modules 1 TTPs 1 IoCs
Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
description ioc Process File opened for reading /proc/modules exe2 -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo exe2 -
Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size exe2 File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size exe2 File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size exe2 -
Reads runtime system information 10 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/self/cpuset exe2 File opened for reading /proc/stat exe2 File opened for reading /proc/bus/pci/devices exe2 File opened for reading /proc/1/environ exe2 File opened for reading /proc/self/cgroup exe2 File opened for reading /proc/stat exe2 File opened for reading /proc/self/cpuset exe2 File opened for reading /proc/stat exe2 File opened for reading /proc/self/status exe2 File opened for reading /proc/self/cpuset exe2
Processes
-
/tmp/exe2/tmp/exe21⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1552 -
/bin/unameuname -s2⤵PID:1556
-
-
/bin/unameuname -r2⤵PID:1557
-
-
/bin/unameuname -m2⤵PID:1558
-
-
/tmp/exe2/tmp/exe22⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1559 -
/bin/unameuname -s3⤵PID:1563
-
-
/bin/unameuname -r3⤵PID:1564
-
-
/bin/unameuname -m3⤵PID:1565
-
-
/tmp/exe2/tmp/exe23⤵
- Reads hardware information
- Reads list of loaded kernel modules
- Checks CPU configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1566 -
/bin/unameuname -s4⤵PID:1570
-
-
/bin/unameuname -r4⤵PID:1571
-
-
/bin/unameuname -m4⤵PID:1572
-
-
-