Analysis
-
max time kernel
143s -
max time network
144s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
17-10-2024 21:05
General
-
Target
na.elf
-
Size
84KB
-
MD5
0e2c42cc4fb874757cee08ed29b134b4
-
SHA1
9b5d9233bbc22cc5a7cdaa858ae365b425a02171
-
SHA256
a1c0b48199e8a47fe50c4097d86e5f43a1a1c9a9c1f7f3606ffa0d45bb4a2eb3
-
SHA512
7c9af743d13826ebf0c1fd2f29201471060727e66296a8432046bb8f1a8d73a7b385fb7feade00acabc84c9366b89db0e6d96f0722af0e4f672e8e194d9443a7
-
SSDEEP
1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3
Malware Config
Extracted
rekoobe
27.124.45.146:12345
Signatures
-
Rekoobe
A Trojan for Linux intended to infect machines with the SPARC architecture and Intel x86, x86-64 computers.
-
Executes dropped EXE 1 IoCs
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/na.elf/tmp/na.elf1⤵
- Writes file to tmp directory
-
/tmp/CCCCCCCC/tmp/CCCCCCCC2⤵
- Executes dropped EXE
- Reads runtime system information
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD50e2c42cc4fb874757cee08ed29b134b4
SHA19b5d9233bbc22cc5a7cdaa858ae365b425a02171
SHA256a1c0b48199e8a47fe50c4097d86e5f43a1a1c9a9c1f7f3606ffa0d45bb4a2eb3
SHA5127c9af743d13826ebf0c1fd2f29201471060727e66296a8432046bb8f1a8d73a7b385fb7feade00acabc84c9366b89db0e6d96f0722af0e4f672e8e194d9443a7