55845e687ddcd2c133d6e30802be2dcc54f27fb8abb894229f76b0767ce56567

Analysis

max time kernel
120s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
10-10-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55845e687ddcd2c133d6e30802be2dcc54f27fb8abb894229f76b0767ce56567.elf
Size

4.7MB
MD5

c20200ae3c8acb3aa23a9097b6099739
SHA1

df920c349a310f6a1532ed05f524f400e85603b3
SHA256

55845e687ddcd2c133d6e30802be2dcc54f27fb8abb894229f76b0767ce56567
SHA512

340e157afe4f7b0800009bb220be56dcaffb0b41409935a4730fcfe6f4775960b1aaa0d804d0a0fbcfb47d451cf8c1b2c17cc2211c88046bc38295721c0c5b16
SSDEEP

49152:MRos/AVhzmQymwq+6r0BCU0hVba2j2O7LIyaXn6k6VjfbtvDGG0U:LIuGq+6r0BL0TM37

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

Processes:

55845e687ddcd2c133d6e30802be2dcc54f27fb8abb894229f76b0767ce56567.elf

description	ioc	process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	55845e687ddcd2c133d6e30802be2dcc54f27fb8abb894229f76b0767ce56567.elf

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

Processes:

55845e687ddcd2c133d6e30802be2dcc54f27fb8abb894229f76b0767ce56567.elf

description	ioc	process
File opened for modification	/tmp/55845e687ddcd2c133d6e30802be2dcc54f27fb8abb894229f76b0767ce56567.elf.pid	55845e687ddcd2c133d6e30802be2dcc54f27fb8abb894229f76b0767ce56567.elf

/tmp/55845e687ddcd2c133d6e30802be2dcc54f27fb8abb894229f76b0767ce56567.elf
/tmp/55845e687ddcd2c133d6e30802be2dcc54f27fb8abb894229f76b0767ce56567.elf
1⤵
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads