Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240729-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240729-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    07-11-2024 03:39

General

  • Target

    f87003a2186bcd4c9e3a3582a8bbc884e48e3faf6f4398463ed254cf257a0456.elf

  • Size

    116KB

  • MD5

    da72e6333e06ec39df537436be9e69ca

  • SHA1

    93da13060c76a396195faeff280afc0bfe4fc312

  • SHA256

    f87003a2186bcd4c9e3a3582a8bbc884e48e3faf6f4398463ed254cf257a0456

  • SHA512

    6fa17ad74542696fe40e4fed339a35bc64bb210788b1e06113a9033d13b7317b782cbbff5e0f431021060106de39934a3e4dcc7ceea9620e19be28185e427993

  • SSDEEP

    3072:bUUFbuueauAv3alZePCqH5nKduWGfv69ny6JP/KTiFi:bUQjekCZqHZEurv69ny6JHKTiFi

Score
9/10

Malware Config

Signatures

  • Contacts a large (13856) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Loads a kernel module 64 IoCs

    Loads a Linux kernel module, potentially to achieve persistence

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 64 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

Processes

  • /tmp/f87003a2186bcd4c9e3a3582a8bbc884e48e3faf6f4398463ed254cf257a0456.elf
    /tmp/f87003a2186bcd4c9e3a3582a8bbc884e48e3faf6f4398463ed254cf257a0456.elf
    1⤵
    • Loads a kernel module
    PID:2496
    • /usr/bin/pkill
      pkill -9 902i13
      2⤵
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:2502
    • /usr/bin/pkill
      pkill -9 BzSxLxBxeY
      2⤵
      • Reads CPU attributes
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:2507
    • /usr/bin/pkill
      pkill -9 HOHO-LUGO7
      2⤵
      • Enumerates kernel/hardware configuration
      PID:2510
    • /usr/bin/pkill
      pkill -9 HOHO-U79OL
      2⤵
      • Enumerates kernel/hardware configuration
      PID:2512
    • /usr/bin/pkill
      pkill -9 JuYfouyf87
      2⤵
      • Reads CPU attributes
      PID:2532
    • /usr/bin/pkill
      pkill -9 NiGGeR69xd
      2⤵
      • Reads CPU attributes
      • Enumerates kernel/hardware configuration
      PID:2534
    • /usr/bin/pkill
      pkill -9 SO190Ij1X
      2⤵
      • Enumerates kernel/hardware configuration
      PID:2536
    • /usr/bin/pkill
      pkill -9 LOLKIKEEEDDE
      2⤵
      • Reads CPU attributes
      PID:2538
    • /usr/bin/pkill
      pkill -9 ekjheory98e
      2⤵
        PID:2540
      • /usr/bin/pkill
        pkill -9 scansh4
        2⤵
          PID:2542
        • /usr/bin/pkill
          pkill -9 MDMA
          2⤵
          • Reads runtime system information
          PID:2544
        • /usr/bin/pkill
          pkill -9 fdevalvex
          2⤵
          • Enumerates kernel/hardware configuration
          PID:2546
        • /usr/bin/pkill
          pkill -9 scanspc
          2⤵
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:2548
        • /usr/bin/pkill
          pkill -9 MELTEDNINJAREALZ
          2⤵
          • Reads CPU attributes
          PID:2550
        • /usr/bin/pkill
          pkill -9 flexsonskids
          2⤵
          • Enumerates kernel/hardware configuration
          PID:2552
        • /usr/bin/pkill
          pkill -9 scanx86
          2⤵
          • Reads CPU attributes
          PID:2554
        • /usr/bin/pkill
          pkill -9 MISAKI-U79OL
          2⤵
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:2556
        • /usr/bin/pkill
          pkill -9 foAxi102kxe
          2⤵
          • Enumerates kernel/hardware configuration
          PID:2558
        • /usr/bin/pkill
          pkill -9 swodjwodjwoj
          2⤵
            PID:2560
          • /usr/bin/pkill
            pkill -9 MmKiy7f87l
            2⤵
            • Enumerates kernel/hardware configuration
            PID:2562
          • /usr/bin/pkill
            pkill -9 freecookiex86
            2⤵
            • Reads CPU attributes
            • Reads runtime system information
            PID:2564
          • /usr/bin/pkill
            pkill -9 sysgpu
            2⤵
            • Reads CPU attributes
            • Reads runtime system information
            PID:2566
          • /usr/bin/pkill
            pkill -9 NiGGeR69xd
            2⤵
              PID:2568
            • /usr/bin/pkill
              pkill -9 frgege
              2⤵
                PID:2570
              • /usr/bin/pkill
                pkill -9 sysupdater
                2⤵
                • Reads runtime system information
                PID:2572
              • /usr/bin/pkill
                pkill -9 0DnAzepd
                2⤵
                • Reads CPU attributes
                PID:2574
              • /usr/bin/pkill
                pkill -9 NiGGeRD0nks69
                2⤵
                • Reads CPU attributes
                PID:2576
              • /usr/bin/pkill
                pkill -9 frgreu
                2⤵
                • Enumerates kernel/hardware configuration
                PID:2578
              • /usr/bin/pkill
                pkill -9 telnetd
                2⤵
                  PID:2583
                • /usr/bin/pkill
                  pkill -9 0x766f6964
                  2⤵
                  • Reads CPU attributes
                  • Enumerates kernel/hardware configuration
                  PID:2585
                • /usr/bin/pkill
                  pkill -9 NiGGeRd0nks1337
                  2⤵
                  • Reads CPU attributes
                  • Enumerates kernel/hardware configuration
                  PID:2587
                • /usr/bin/pkill
                  pkill -9 gaft
                  2⤵
                  • Enumerates kernel/hardware configuration
                  PID:2589
                • /usr/bin/pkill
                  pkill -9 urasgbsigboa
                  2⤵
                  • Reads CPU attributes
                  PID:2591
                • /usr/bin/pkill
                  pkill -9 120i3UI49
                  2⤵
                  • Enumerates kernel/hardware configuration
                  PID:2593
                • /usr/bin/pkill
                  pkill -9 OaF3
                  2⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:2595
                • /usr/bin/pkill
                  pkill -9 geae
                  2⤵
                  • Enumerates kernel/hardware configuration
                  PID:2597
                • /usr/bin/pkill
                  pkill -9 vaiolmao
                  2⤵
                  • Reads runtime system information
                  PID:2599
                • /usr/bin/pkill
                  pkill -9 123123a
                  2⤵
                  • Reads CPU attributes
                  • Reads runtime system information
                  PID:2601
                • /usr/bin/pkill
                  pkill -9 Ofurain0n4H34D
                  2⤵
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:2603
                • /usr/bin/pkill
                  pkill -9 ggTrex
                  2⤵
                  • Reads CPU attributes
                  PID:2605
                • /usr/bin/pkill
                  pkill -9 wasads
                  2⤵
                  • Reads CPU attributes
                  PID:2607
                • /usr/bin/pkill
                  pkill -9 1293194hjXD
                  2⤵
                    PID:2609
                  • /usr/bin/pkill
                    pkill -9 OthLaLosn
                    2⤵
                      PID:2611
                    • /usr/bin/pkill
                      pkill -9 ggt
                      2⤵
                      • Reads CPU attributes
                      PID:2613
                    • /usr/bin/pkill
                      pkill -9 wget-log
                      2⤵
                      • Reads runtime system information
                      PID:2615
                    • /usr/bin/pkill
                      pkill -9 1337SoraLOADER
                      2⤵
                      • Reads CPU attributes
                      PID:2617
                    • /usr/bin/pkill
                      pkill -9 SAIAKINA
                      2⤵
                      • Reads CPU attributes
                      PID:2619
                    • /usr/bin/pkill
                      pkill -9 ggtq
                      2⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:2621
                    • /usr/bin/pkill
                      pkill -9 1378bfp919GRB1Q2
                      2⤵
                      • Reads runtime system information
                      PID:2623
                    • /usr/bin/pkill
                      pkill -9 SAIAKUSO
                      2⤵
                      • Reads CPU attributes
                      • Enumerates kernel/hardware configuration
                      • Reads runtime system information
                      PID:2625
                    • /usr/bin/pkill
                      pkill -9 ggtr
                      2⤵
                      • Reads CPU attributes
                      PID:2627
                    • /usr/bin/pkill
                      pkill -9 14Fa
                      2⤵
                      • Reads runtime system information
                      PID:2629
                    • /usr/bin/pkill
                      pkill -9 SEXSLAVE1337
                      2⤵
                      • Reads CPU attributes
                      • Enumerates kernel/hardware configuration
                      PID:2631
                    • /usr/bin/pkill
                      pkill -9 ggtt
                      2⤵
                      • Enumerates kernel/hardware configuration
                      PID:2633
                    • /usr/bin/pkill
                      pkill -9 1902a3u912u3u4
                      2⤵
                      • Enumerates kernel/hardware configuration
                      PID:2635
                    • /usr/bin/pkill
                      pkill -9 SO190Ij1X
                      2⤵
                      • Reads CPU attributes
                      • Enumerates kernel/hardware configuration
                      PID:2637
                    • /usr/bin/pkill
                      pkill -9 haetrghbr
                      2⤵
                      • Reads CPU attributes
                      • Enumerates kernel/hardware configuration
                      • Reads runtime system information
                      PID:2639
                    • /usr/bin/pkill
                      pkill -9 19ju3d
                      2⤵
                      • Reads CPU attributes
                      PID:2641
                    • /usr/bin/pkill
                      pkill -9 SORAojkf120
                      2⤵
                      • Enumerates kernel/hardware configuration
                      PID:2643
                    • /usr/bin/pkill
                      pkill -9 hehahejeje92
                      2⤵
                      • Reads CPU attributes
                      • Enumerates kernel/hardware configuration
                      • Reads runtime system information
                      PID:2645
                    • /usr/bin/pkill
                      pkill -9 2U2JDJA901F91
                      2⤵
                      • Enumerates kernel/hardware configuration
                      • Reads runtime system information
                      PID:2647
                    • /usr/bin/pkill
                      pkill -9 SlaVLav12
                      2⤵
                      • Reads runtime system information
                      PID:2649
                    • /usr/bin/pkill
                      pkill -9 helpmedaddthhhhh
                      2⤵
                        PID:2651
                      • /usr/bin/pkill
                        pkill -9 2wgg9qphbq
                        2⤵
                        • Reads CPU attributes
                        • Enumerates kernel/hardware configuration
                        PID:2653
                      • /usr/bin/pkill
                        pkill -9 Slav3Th3seD3vices
                        2⤵
                        • Reads CPU attributes
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:2655
                      • /usr/bin/pkill
                        pkill -9 hzSmYZjYMQ
                        2⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:2657
                      • /usr/bin/pkill
                        pkill -9 5Gbf
                        2⤵
                        • Reads CPU attributes
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:2659
                      • /usr/bin/pkill
                        pkill -9 SoRAxD123LOL
                        2⤵
                        • Reads CPU attributes
                        PID:2661
                      • /usr/bin/pkill
                        pkill -9 iaGv
                        2⤵
                        • Reads runtime system information
                        PID:2663
                      • /usr/bin/pkill
                        pkill -9 5aA3
                        2⤵
                        • Reads CPU attributes
                        • Enumerates kernel/hardware configuration
                        PID:2665
                      • /usr/bin/pkill
                        pkill -9 SoRAxD420LOL
                        2⤵
                        • Reads runtime system information
                        PID:2667
                      • /usr/bin/pkill
                        pkill -9 insomni
                        2⤵
                        • Reads CPU attributes
                        PID:2669
                      • /usr/bin/pkill
                        pkill -9 640277
                        2⤵
                        • Enumerates kernel/hardware configuration
                        PID:2671
                      • /usr/bin/pkill
                        pkill -9 SoraBeReppin1337
                        2⤵
                        • Enumerates kernel/hardware configuration
                        PID:2673
                      • /usr/bin/pkill
                        pkill -9 ipcamCache
                        2⤵
                        • System Network Configuration Discovery
                        PID:2675
                      • /usr/bin/pkill
                        pkill -9 66tlGg9Q
                        2⤵
                        • Enumerates kernel/hardware configuration
                        PID:2677
                      • /usr/bin/pkill
                        pkill -9 T
                        2⤵
                        • Reads CPU attributes
                        • Reads runtime system information
                        PID:2679
                      • /usr/bin/pkill
                        pkill -9 jUYfouyf87
                        2⤵
                        • Reads CPU attributes
                        • Reads runtime system information
                        PID:2681
                      • /usr/bin/pkill
                        pkill -9 6ke3
                        2⤵
                        • Reads CPU attributes
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:2683
                      • /usr/bin/pkill
                        pkill -9 TOKYO3
                        2⤵
                          PID:2685
                        • /usr/bin/pkill
                          pkill -9 lyEeaXul2dULCVxh
                          2⤵
                          • Reads CPU attributes
                          • Enumerates kernel/hardware configuration
                          PID:2687
                        • /usr/bin/pkill
                          pkill -9 93OfjHZ2z
                          2⤵
                            PID:2689
                          • /usr/bin/pkill
                            pkill -9 TY2gD6MZvKc7KU6r
                            2⤵
                              PID:2691
                            • /usr/bin/pkill
                              pkill -9 mMkiy6f87l
                              2⤵
                                PID:2693
                              • /usr/bin/pkill
                                pkill -9 A023UU4U24UIU
                                2⤵
                                • Reads CPU attributes
                                • Enumerates kernel/hardware configuration
                                PID:2695
                              • /usr/bin/pkill
                                pkill -9 TheWeeknd
                                2⤵
                                • Reads CPU attributes
                                • Enumerates kernel/hardware configuration
                                PID:2697
                              • /usr/bin/pkill
                                pkill -9 mioribitches
                                2⤵
                                • Enumerates kernel/hardware configuration
                                • Reads runtime system information
                                PID:2699
                              • /usr/bin/pkill
                                pkill -9 A5p9
                                2⤵
                                • Enumerates kernel/hardware configuration
                                PID:2701
                              • /usr/bin/pkill
                                pkill -9 TheWeeknds
                                2⤵
                                • Reads runtime system information
                                PID:2703
                              • /usr/bin/pkill
                                pkill -9 mnblkjpoi
                                2⤵
                                • Enumerates kernel/hardware configuration
                                PID:2705
                              • /usr/bin/pkill
                                pkill -9 AbAd
                                2⤵
                                  PID:2707
                                • /usr/bin/pkill
                                  pkill -9 Tokyos
                                  2⤵
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:2709
                                • /usr/bin/pkill
                                  pkill -9 neb
                                  2⤵
                                  • Reads CPU attributes
                                  • Enumerates kernel/hardware configuration
                                  PID:2711
                                • /usr/bin/pkill
                                  pkill -9 Akiru
                                  2⤵
                                  • Reads CPU attributes
                                  PID:2713
                                • /usr/bin/pkill
                                  pkill -9 U8inTz
                                  2⤵
                                  • Enumerates kernel/hardware configuration
                                  PID:2715
                                • /usr/bin/pkill
                                  pkill -9 netstats
                                  2⤵
                                  • Reads CPU attributes
                                  • Enumerates kernel/hardware configuration
                                  PID:2717
                                • /usr/bin/pkill
                                  pkill -9 Alex
                                  2⤵
                                  • Reads CPU attributes
                                  PID:2719
                                • /usr/bin/pkill
                                  pkill -9 W9RCAKM20T
                                  2⤵
                                  • Enumerates kernel/hardware configuration
                                  PID:2721
                                • /usr/bin/pkill
                                  pkill -9 newnetword
                                  2⤵
                                  • Reads runtime system information
                                  PID:2723
                                • /usr/bin/pkill
                                  pkill -9 Ayo215
                                  2⤵
                                  • Enumerates kernel/hardware configuration
                                  PID:2725
                                • /usr/bin/pkill
                                  pkill -9 Word
                                  2⤵
                                  • Reads runtime system information
                                  PID:2727
                                • /usr/bin/pkill
                                  pkill -9 nloads
                                  2⤵
                                  • Reads runtime system information
                                  PID:2729
                                • /usr/bin/pkill
                                  pkill -9 BAdAsV
                                  2⤵
                                  • Reads CPU attributes
                                  • Enumerates kernel/hardware configuration
                                  PID:2731
                                • /usr/bin/pkill
                                  pkill -9 Wordmane
                                  2⤵
                                  • Enumerates kernel/hardware configuration
                                  PID:2733
                                • /usr/bin/pkill
                                  pkill -9 notyakuzaa
                                  2⤵
                                  • Reads CPU attributes
                                  • Enumerates kernel/hardware configuration
                                  PID:2735
                                • /usr/bin/pkill
                                  pkill -9 Belch
                                  2⤵
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:2737
                                • /usr/bin/pkill
                                  pkill -9 Wordnets
                                  2⤵
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:2739
                                • /usr/bin/pkill
                                  pkill -9 obp
                                  2⤵
                                  • Enumerates kernel/hardware configuration
                                  PID:2741
                                • /usr/bin/pkill
                                  pkill -9 BigN0gg0r420
                                  2⤵
                                    PID:2743
                                  • /usr/bin/pkill
                                    pkill -9 X0102I34f
                                    2⤵
                                    • Reads CPU attributes
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:2746
                                  • /usr/bin/pkill
                                    pkill -9 ofhasfhiafhoi
                                    2⤵
                                    • Reads CPU attributes
                                    • Enumerates kernel/hardware configuration
                                    PID:2748
                                  • /usr/bin/pkill
                                    pkill -9 BzSxLxBxeY
                                    2⤵
                                    • Reads CPU attributes
                                    • Reads runtime system information
                                    PID:2750
                                  • /usr/bin/pkill
                                    pkill -9 X19I239124UIU
                                    2⤵
                                      PID:2752
                                    • /usr/bin/pkill
                                      pkill -9 oism
                                      2⤵
                                      • Enumerates kernel/hardware configuration
                                      PID:2762
                                    • /usr/bin/pkill
                                      pkill -9 Deported
                                      2⤵
                                      • Reads CPU attributes
                                      • Reads runtime system information
                                      PID:2771
                                    • /usr/bin/pkill
                                      pkill -9 XSHJEHHEIIHWO
                                      2⤵
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      PID:2773
                                    • /usr/bin/pkill
                                      pkill -9 olsVNwo12
                                      2⤵
                                      • Reads CPU attributes
                                      • Reads runtime system information
                                      PID:2775
                                    • /usr/bin/pkill
                                      pkill -9 DeportedDeported
                                      2⤵
                                      • Reads CPU attributes
                                      PID:2777
                                    • /usr/bin/pkill
                                      pkill -9 XkTer0GbA1
                                      2⤵
                                      • Reads runtime system information
                                      PID:2779
                                    • /usr/bin/pkill
                                      pkill -9 onry0v03
                                      2⤵
                                        PID:2781
                                      • /usr/bin/pkill
                                        pkill -9 FortniteDownLOLZ
                                        2⤵
                                        • Reads runtime system information
                                        PID:2783
                                      • /usr/bin/pkill
                                        pkill -9 Y0urM0mGay
                                        2⤵
                                        • Enumerates kernel/hardware configuration
                                        PID:2785
                                      • /usr/bin/pkill
                                        pkill -9 pussyfartlmaojk
                                        2⤵
                                        • Reads runtime system information
                                        PID:2787
                                      • /usr/bin/pkill
                                        pkill -9 GrAcEnIgGeRaNn
                                        2⤵
                                        • Reads CPU attributes
                                        PID:2792
                                      • /usr/bin/pkill
                                        pkill -9 YvdGkqndCO
                                        2⤵
                                        • Enumerates kernel/hardware configuration
                                        • Reads runtime system information
                                        PID:2794
                                      • /usr/bin/pkill
                                        pkill -9 qGeoRBe6BE
                                        2⤵
                                        • Reads CPU attributes
                                        • Enumerates kernel/hardware configuration
                                        • Reads runtime system information
                                        PID:2796
                                      • /usr/bin/pkill
                                        pkill -9 GuiltyCrown
                                        2⤵
                                        • Reads CPU attributes
                                        • Enumerates kernel/hardware configuration
                                        PID:2798
                                      • /usr/bin/pkill
                                        pkill -9 ZEuS69
                                        2⤵
                                          PID:2800
                                        • /usr/bin/pkill
                                          pkill -9 s4beBsEQhd
                                          2⤵
                                          • Reads CPU attributes
                                          • Reads runtime system information
                                          PID:2802
                                        • /usr/bin/pkill
                                          pkill -9 HOHO-KSNDO
                                          2⤵
                                          • Reads runtime system information
                                          PID:2804
                                        • /usr/bin/pkill
                                          pkill -9 ZEuz69
                                          2⤵
                                          • Reads CPU attributes
                                          PID:2806
                                        • /usr/bin/pkill
                                          pkill -9 sat1234
                                          2⤵
                                          • Reads runtime system information
                                          PID:2808
                                        • /usr/bin/pkill
                                          pkill -9 HOHO-LUGO7
                                          2⤵
                                            PID:2810
                                          • /usr/bin/pkill
                                            pkill -9 aj93hJ23
                                            2⤵
                                            • Reads CPU attributes
                                            • Enumerates kernel/hardware configuration
                                            PID:2812
                                          • /usr/bin/pkill
                                            pkill -9 scanHA
                                            2⤵
                                            • Reads CPU attributes
                                            PID:2814
                                          • /usr/bin/pkill
                                            pkill -9 HOHO-U79OL
                                            2⤵
                                            • Reads CPU attributes
                                            • Reads runtime system information
                                            PID:2816
                                          • /usr/bin/pkill
                                            pkill -9 alie293z0k2L
                                            2⤵
                                            • Reads CPU attributes
                                            • Enumerates kernel/hardware configuration
                                            • Reads runtime system information
                                            PID:2818
                                          • /usr/bin/pkill
                                            pkill -9 scanJoshoARM
                                            2⤵
                                              PID:2820

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads