Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
12-10-2024 15:09
Behavioral task
behavioral1
Sample
na.elf
Resource
ubuntu1804-amd64-20240729-en
General
-
Target
na.elf
-
Size
61KB
-
MD5
a77a0c4cae045164ddcae466b1943cd1
-
SHA1
f8c9ce658693ff2e86ac7ea5a64bb0adcc45eb02
-
SHA256
86232d7ac334760fce0ed107b063bc2c69b2c16d9dc5b23e3797436c01464b44
-
SHA512
ead8ff900abc2ee3758a524a3d4acc14c4e590d424e5abb88057afa3740c704f04d78be300237f3fdadac25d62cf6de83461ee0403fa05595b427f1690ccfb24
-
SSDEEP
1536:Z7qARubgzY/bEJyQRcp780LDHhklv4JQC9DSW:NP+eY/bEJWJXBk9AP9l
Malware Config
Signatures
-
Contacts a large (87601) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
na.elfdescription ioc process File opened for modification /dev/watchdog na.elf File opened for modification /dev/misc/watchdog na.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
na.elfdescription ioc process File opened for reading /proc/net/tcp na.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 38 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
Processes:
na.elfdescription ioc process File opened for reading /proc/460/maps na.elf File opened for reading /proc/521/maps na.elf File opened for reading /proc/677/maps na.elf File opened for reading /proc/480/maps na.elf File opened for reading /proc/724/maps na.elf File opened for reading /proc/523/maps na.elf File opened for reading /proc/610/maps na.elf File opened for reading /proc/712/maps na.elf File opened for reading /proc/955/maps na.elf File opened for reading /proc/967/maps na.elf File opened for reading /proc/470/maps na.elf File opened for reading /proc/491/maps na.elf File opened for reading /proc/609/maps na.elf File opened for reading /proc/668/maps na.elf File opened for reading /proc/561/maps na.elf File opened for reading /proc/581/maps na.elf File opened for reading /proc/965/maps na.elf File opened for reading /proc/406/maps na.elf File opened for reading /proc/426/maps na.elf File opened for reading /proc/465/maps na.elf File opened for reading /proc/467/maps na.elf File opened for reading /proc/411/maps na.elf File opened for reading /proc/556/maps na.elf File opened for reading /proc/650/maps na.elf File opened for reading /proc/682/maps na.elf File opened for reading /proc/959/maps na.elf File opened for reading /proc/461/maps na.elf File opened for reading /proc/464/maps na.elf File opened for reading /proc/553/maps na.elf File opened for reading /proc/649/maps na.elf File opened for reading /proc/652/maps na.elf File opened for reading /proc/735/maps na.elf File opened for reading /proc/930/maps na.elf File opened for reading /proc/969/maps na.elf File opened for reading /proc/407/maps na.elf File opened for reading /proc/462/maps na.elf File opened for reading /proc/475/maps na.elf File opened for reading /proc/492/maps na.elf -
Changes its process name 1 IoCs
Processes:
na.elfdescription pid process Changes the process name, possibly in an attempt to hide itself 1510 na.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
na.elfdescription ioc process File opened for reading /proc/net/tcp na.elf -
Processes:
na.elfdescription ioc process File opened for reading /proc/1318/maps na.elf File opened for reading /proc/1146/maps na.elf File opened for reading /proc/1231/maps na.elf File opened for reading /proc/1133/maps na.elf File opened for reading /proc/1150/maps na.elf File opened for reading /proc/1167/maps na.elf File opened for reading /proc/1189/maps na.elf File opened for reading /proc/1190/maps na.elf File opened for reading /proc/1507/maps na.elf File opened for reading /proc/1121/maps na.elf File opened for reading /proc/1125/maps na.elf File opened for reading /proc/1601/maps na.elf File opened for reading /proc/1174/maps na.elf File opened for reading /proc/1264/maps na.elf File opened for reading /proc/1545/maps na.elf File opened for reading /proc/1566/maps na.elf File opened for reading /proc/1580/maps na.elf File opened for reading /proc/1594/maps na.elf File opened for reading /proc/1101/maps na.elf File opened for reading /proc/1137/maps na.elf File opened for reading /proc/1313/maps na.elf File opened for reading /proc/1573/maps na.elf File opened for reading /proc/1077/maps na.elf File opened for reading /proc/1088/maps na.elf File opened for reading /proc/1310/maps na.elf File opened for reading /proc/1529/maps na.elf File opened for reading /proc/1068/maps na.elf File opened for reading /proc/1074/maps na.elf File opened for reading /proc/1111/maps na.elf File opened for reading /proc/1245/maps na.elf File opened for reading /proc/1337/maps na.elf File opened for reading /proc/1536/maps na.elf File opened for reading /proc/1559/maps na.elf File opened for reading /proc/1092/maps na.elf File opened for reading /proc/1191/maps na.elf File opened for reading /proc/1339/maps na.elf File opened for reading /proc/1482/maps na.elf File opened for reading /proc/1587/maps na.elf File opened for reading /proc/1051/maps na.elf File opened for reading /proc/1160/maps na.elf File opened for reading /proc/1154/maps na.elf File opened for reading /proc/1291/maps na.elf File opened for reading /proc/1521/maps na.elf File opened for reading /proc/1173/maps na.elf File opened for reading /proc/1200/maps na.elf File opened for reading /proc/1516/maps na.elf File opened for reading /proc/1193/maps na.elf File opened for reading /proc/1503/maps na.elf File opened for reading /proc/1277/maps na.elf File opened for reading /proc/1295/maps na.elf File opened for reading /proc/1384/maps na.elf File opened for reading /proc/1513/maps na.elf File opened for reading /proc/1064/maps na.elf File opened for reading /proc/1156/maps na.elf File opened for reading /proc/1263/maps na.elf File opened for reading /proc/1552/maps na.elf File opened for reading /proc/1031/maps na.elf File opened for reading /proc/1141/maps na.elf File opened for reading /proc/1180/maps na.elf File opened for reading /proc/1192/maps na.elf File opened for reading /proc/1197/maps na.elf File opened for reading /proc/1615/maps na.elf File opened for reading /proc/1045/maps na.elf File opened for reading /proc/1172/maps na.elf