70b15d619bfd1105a68c6931b4b87c69bdedc7634cfe0e2b5fd9ecd991106022 | Triage

Analysis

max time kernel
133s
max time network
149s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
12-10-2024 15:50

Sharing

Report Analysis Logs

General

Target

na.elf
Size

88KB
MD5

44dbfede755657975902e5aa27f64ab5
SHA1

557ef9acd901def83fb9b361fe249ae021d03805
SHA256

70b15d619bfd1105a68c6931b4b87c69bdedc7634cfe0e2b5fd9ecd991106022
SHA512

67c1149764703a148fec5d1e4c46c0e04d6888f9b55076f9e5131e8d85ff228c8c9d2294dc5476dfc704c37447ddc0aa47e4887b7a639b845a79e0f509c55944
SSDEEP

1536:mPVa04qPbpnU4y6iN/+qGv5y3j39AVTGZ+MO/yaSCLosF:sI04qPbpU4viN/+qGv8zCViZ+bazns

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1569	na.elf

Traces itself 2 IoCs

Traces itself to prevent debugging attempts

pid	Process
1569	na.elf
1570	na.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	httpd	1569	na.elf

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/na.elf	na.elf

/tmp/na.elf
/tmp/na.elf
1⤵
- Deletes itself
- Traces itself
- Changes its process name
- Writes file to tmp directory
PID:1569

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads