Analysis
-
max time kernel
150s -
max time network
155s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
04-11-2024 02:27
Static task
static1
Behavioral task
behavioral1
Sample
5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf
Resource
debian9-armhf-20240611-en
General
-
Target
5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf
-
Size
177KB
-
MD5
786d75a158fe731feca3880f436082c0
-
SHA1
79ea2734e43d00cdeabed5586b2c1994d02aef3e
-
SHA256
5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18
-
SHA512
7984ebc874563267570f828ee158e4860971e184900e3590ac3b4829285443e065dd1ad4df190ceabf575880a4cd8ead4dd1132e9c1650239accf3f6440a3f7f
-
SSDEEP
3072:PJtid2ng8w4YMrgUqqdaODUvI7UhTIyU2be6CXuVyZM/9h9XKvtZmmmLdwC7tuRD:BtiGGqaODUvI4hc2bvCXuVoM/9PXwPmK
Malware Config
Signatures
-
Contacts a large (2091) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Renames itself 1 IoCs
Processes:
5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elfpid Process 670 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabdescription ioc Process File opened for modification /var/spool/cron/crontabs/tmp.hNu9EA crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elfcrontabdescription ioc Process File opened for reading /proc/873/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/961/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/141/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/693/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/702/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/838/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/844/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/802/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/825/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/849/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/3/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/447/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/688/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/726/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/790/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/861/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/863/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/918/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/935/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/1001/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/750/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/760/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/808/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/887/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/933/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/981/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/5/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/20/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/757/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/835/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/874/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/17/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/25/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/907/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/1005/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/922/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/995/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/18/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/filesystems crontab File opened for reading /proc/703/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/705/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/718/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/921/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/927/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/1002/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/1017/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/713/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/796/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/809/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/727/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/795/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/834/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/43/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/107/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/707/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/883/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/982/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/940/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/404/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/779/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/784/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/812/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/879/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf File opened for reading /proc/801/cmdline 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf
Processes
-
/tmp/5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf/tmp/5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18.elf1⤵
- Renames itself
- Reads runtime system information
PID:669 -
/bin/shsh -c "crontab -l"2⤵PID:671
-
/usr/bin/crontabcrontab -l3⤵PID:672
-
-
-
/bin/shsh -c "crontab -"2⤵PID:681
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
- Reads runtime system information
PID:682
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210B
MD51c13a495200a6c86903fdbc94d567493
SHA1fa7c84c60697e5cdb32129fb86173d8d43357329
SHA256a39970e5907b4e3abead62969de33fc83436ac71054cca8b343c132de62f1981
SHA512f2bd6ad99c5c5917ad92aed71b9d7d398bf58b9ebce2ec4a45a2c60d71216d85a86db98c598286d7ffb4dfc7afc8c8ab6cbcb37cd81775d1715260fcf7f44fcc