Analysis
-
max time kernel
145s -
max time network
132s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
30-08-2024 17:58
Static task
static1
Behavioral task
behavioral1
Sample
exe2
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
exe2
Resource
ubuntu2004-amd64-20240611-en
Behavioral task
behavioral3
Sample
exe2
Resource
ubuntu2204-amd64-20240729-en
General
-
Target
exe2
-
Size
7.8MB
-
MD5
0a2f3c43b33dedc9ce4144125a21edb6
-
SHA1
114a54c77385e6a06dcc88a522dcf80a0533d748
-
SHA256
15dc859276438bb55a1bcbf226b4b6b18b471c0f2fcee8a68e953da61af12d8f
-
SHA512
e45c7587cd18e765cff7776c8391586125315b98a979a99077337045dcc86522ec1e7cd52c33d6c973b0578c6207feeb1ed884e7dbc222a96daf71ef22edc09b
-
SSDEEP
49152:lLOIKx9eGrb/TSvO90dL3BmAFd4A64nsfJos81upTcr7fWg25g1tGoLNF8/be4Y8:lLH/tLJ2Q7fOrtTNUls0tQiLvE
Malware Config
Signatures
-
Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/class/dmi/id/product_uuid exe2 -
Reads list of loaded kernel modules 1 TTPs 1 IoCs
Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
description ioc Process File opened for reading /proc/modules exe2 -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo exe2 -
Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size exe2 File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size exe2 File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size exe2 -
Reads runtime system information 10 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/bus/pci/devices exe2 File opened for reading /proc/self/status exe2 File opened for reading /proc/self/cgroup exe2 File opened for reading /proc/stat exe2 File opened for reading /proc/stat exe2 File opened for reading /proc/stat exe2 File opened for reading /proc/1/environ exe2 File opened for reading /proc/self/cpuset exe2 File opened for reading /proc/self/cpuset exe2 File opened for reading /proc/self/cpuset exe2
Processes
-
/tmp/exe2/tmp/exe21⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2418 -
/usr/bin/unameuname -s2⤵PID:2422
-
-
/usr/bin/unameuname -r2⤵PID:2423
-
-
/usr/bin/unameuname -m2⤵PID:2424
-
-
/tmp/exe2/tmp/exe22⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2425 -
/usr/bin/unameuname -s3⤵PID:2428
-
-
/usr/bin/unameuname -r3⤵PID:2429
-
-
/usr/bin/unameuname -m3⤵PID:2430
-
-
/tmp/exe2/tmp/exe23⤵
- Reads hardware information
- Reads list of loaded kernel modules
- Checks CPU configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2431 -
/usr/bin/unameuname -s4⤵PID:2434
-
-
/usr/bin/unameuname -r4⤵PID:2435
-
-
/usr/bin/unameuname -m4⤵PID:2436
-
-
-