Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    07/11/2024, 15:04

General

  • Target

    i586.elf

  • Size

    76KB

  • MD5

    292a935f88709ad9c0c026cb95ff47ea

  • SHA1

    303a11c61dc3af6ca1afe864c8b0a5acc2e8704a

  • SHA256

    39c67b545cdea6a9a65494859e839d4e6eee5318ba1f1b2a53b8c07f61eb21fd

  • SHA512

    ee089a89f426c52b75e28447dee513828982757adbd9aafd5ffeeac32999d3ee28f5f0f7eac5e734a6c165a04e5426f10bbc94dd7ad0ab0a7401e2c320dd1a2d

  • SSDEEP

    1536:vqVeO+uSCp1/2FgBxSie11/LMrrMnouy8GylTzO065gS6U:yhBsWAiBMouttzO065p6U

Score
6/10

Malware Config

Signatures

  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/i586.elf
    /tmp/i586.elf
    1⤵
    • Reads system routing table
    • Reads system network configuration
    • Writes file to tmp directory
    PID:1507

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /tmp/Infected.log

          Filesize

          107B

          MD5

          a70a5dde6f79eaea4e71c88b6a2ccc38

          SHA1

          92c0273c4be5d4b7bdbdd500de5a64e5e05652b2

          SHA256

          d087a5a10a09b589993d8cc44a24ef22db26ffd0feeeb3f29b15af008c292af8

          SHA512

          aaa7d00faa34a87292f23a16dae8a7a4b5a40c8e375a579f1286427819c2a04e1c6f970dbc0f2433e6c03f59a2ece0f28ba1e8fc526bc4afe77f176f61876c52