Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    21/10/2024, 01:46

General

  • Target

    948390fd35078a8a71ea39d337d0fd9bcd21416d67d1022957c1a061521e9f84.elf

  • Size

    7.9MB

  • MD5

    b0c0dfbb529a4a84eb71c3f3d4ccc906

  • SHA1

    fbc7ee0285f2779c777b49618baff328c154220f

  • SHA256

    948390fd35078a8a71ea39d337d0fd9bcd21416d67d1022957c1a061521e9f84

  • SHA512

    ce762354cb1403ca53e3b065e83f1d7485fb163d2c299ec0dd087478a08d723b7cb0f39abacc464ec35ff91aaaa656213a95906b8b45047e0c43bca3651431ba

  • SSDEEP

    98304:lrGqdvoYi1chcfuk+zX0DekIBEnOWlQhy9NPE4Gjv41+LEu4vdrw7c9KMWkUm/sF:bi1DGjwhdXpisN9xcKZP2H5Aa

Score
6/10

Malware Config

Signatures

  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 45 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 27 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 7 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/948390fd35078a8a71ea39d337d0fd9bcd21416d67d1022957c1a061521e9f84.elf
    /tmp/948390fd35078a8a71ea39d337d0fd9bcd21416d67d1022957c1a061521e9f84.elf
    1⤵
    • Checks hardware identifiers (DMI)
    • Reads hardware information
    • Checks CPU configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1588

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /tmp/cert_key.pem

          Filesize

          1KB

          MD5

          e6244d7c672ef3bd3ee944c3e2222cbd

          SHA1

          60cc4cb40137e9e96f884f20c3274254569bfb59

          SHA256

          79c946bdd691bb127ddcea4e4196e0401e007c6494fd208516c2b7340a7c2ac4

          SHA512

          7de72dcf0bce0aac924768739c3a89d4c243f81d9d16ec32225a2cb6945d8ecc5780a2f1c0f0cba4384672b96cd8ca7e29e15d96527c14dd066ad09cb8aed13c