Analysis
-
max time kernel
30s -
max time network
30s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
-
submitted
10-10-2024 19:31
General
-
Target
la.bot.x86_64
-
Size
100KB
-
MD5
a3f67ac224de01e16985b4267ee604aa
-
SHA1
6bfe1b330a564e0b33099cd7f0fbd3cea4c0c7a5
-
SHA256
e0434ad08fdfe7930eddd5c2ae1de32432b784d513db5819c98956c1302f2bb1
-
SHA512
2b8720a2863ff346f35cfc1569227faf1afb42565053cf7f588e126fb4f57d41b18de5fd4a96b885fa69a3f9fd5a7d867edafea57c6a209ac268d94b2bc1fdb7
-
SSDEEP
1536:ltvbwv3laTn/rm2gnmJcc8SAkFKavilQq8IeTHH:ltva8Tn/rmzSAovib8IeTH
Malware Config
Signatures
-
Contacts a large (14233) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Renames itself 1 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Reads process memory 1 TTPs 1 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
-
Changes its process name 1 IoCs
Processes
-
/tmp/la.bot.x86_64/tmp/la.bot.x86_641⤵
- Modifies Watchdog functionality
- Renames itself
- Reads process memory
- Changes its process name