Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
14-11-2024 14:42
Static task
static1
Behavioral task
behavioral1
Sample
x86.elf
Resource
ubuntu2204-amd64-20240729-en
General
-
Target
x86.elf
-
Size
70KB
-
MD5
530a5304e7256d256700b548616850a1
-
SHA1
1df0d3cc1e88338412b289873d6918410bbc37f7
-
SHA256
38f87bfc7e5574b31afd056fcfdea9716165ddfbb9d533e996dbf24dbc998862
-
SHA512
99fad4f4d228598a3ce122228b8433ec4bb7922f82cd89e99cda9d52fcead2c68166e2acc6381e892e9f47286d06e8c45fccf9fa46fc04c2e61d1d1c35631942
-
SSDEEP
1536:XVdKDYm7awu+ziiv3JWcrIdwIrgmysekB:XVdKDYm7jFiivBMdwtmV
Malware Config
Signatures
-
Contacts a large (36879) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
x86.elfdescription ioc Process File opened for modification /dev/watchdog x86.elf File opened for modification /dev/misc/watchdog x86.elf -
Renames itself 1 IoCs
Processes:
x86.elfpid Process 1565 x86.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 37.252.191.197 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
x86.elfdescription ioc Process File opened for reading /proc/net/tcp x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 1 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
Processes:
x86.elfdescription ioc Process File opened for reading /proc/1/maps x86.elf -
Changes its process name 13 IoCs
Processes:
x86.elfdescription ioc pid Process Changes the process name, possibly in an attempt to hide itself boa 1565 x86.elf Changes the process name, possibly in an attempt to hide itself boa 1568 x86.elf Changes the process name, possibly in an attempt to hide itself boa 1568 x86.elf Changes the process name, possibly in an attempt to hide itself upnpc-static 1568 x86.elf Changes the process name, possibly in an attempt to hide itself lighttpd 1568 x86.elf Changes the process name, possibly in an attempt to hide itself udhcpc 1568 x86.elf Changes the process name, possibly in an attempt to hide itself telnetd 1568 x86.elf Changes the process name, possibly in an attempt to hide itself /usr/bin/inetd 1568 x86.elf Changes the process name, possibly in an attempt to hide itself telnetd 1568 x86.elf Changes the process name, possibly in an attempt to hide itself lighttpd 1568 x86.elf Changes the process name, possibly in an attempt to hide itself ntpclient 1568 x86.elf Changes the process name, possibly in an attempt to hide itself ntpclient 1568 x86.elf Changes the process name, possibly in an attempt to hide itself /usr/bin/inetd 1568 x86.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
x86.elfdescription ioc Process File opened for reading /proc/net/tcp x86.elf -
Processes:
x86.elfdescription ioc Process File opened for reading /proc/426/fd x86.elf File opened for reading /proc/585/fd x86.elf File opened for reading /proc/24/fd x86.elf File opened for reading /proc/73/fd x86.elf File opened for reading /proc/160/fd x86.elf File opened for reading /proc/75/fd x86.elf File opened for reading /proc/77/fd x86.elf File opened for reading /proc/89/fd x86.elf File opened for reading /proc/199/fd x86.elf File opened for reading /proc/639/fd x86.elf File opened for reading /proc/1/fd x86.elf File opened for reading /proc/93/fd x86.elf File opened for reading /proc/197/fd x86.elf File opened for reading /proc/506/fd x86.elf File opened for reading /proc/17/fd x86.elf File opened for reading /proc/640/fd x86.elf File opened for reading /proc/11/fd x86.elf File opened for reading /proc/14/fd x86.elf File opened for reading /proc/592/fd x86.elf File opened for reading /proc/82/fd x86.elf File opened for reading /proc/314/fd x86.elf File opened for reading /proc/737/fd x86.elf File opened for reading /proc/3/fd x86.elf File opened for reading /proc/588/fd x86.elf File opened for reading /proc/723/fd x86.elf File opened for reading /proc/220/fd x86.elf File opened for reading /proc/315/fd x86.elf File opened for reading /proc/542/fd x86.elf File opened for reading /proc/664/fd x86.elf File opened for reading /proc/12/fd x86.elf File opened for reading /proc/13/fd x86.elf File opened for reading /proc/221/fd x86.elf File opened for reading /proc/6/fd x86.elf File opened for reading /proc/16/fd x86.elf File opened for reading /proc/92/fd x86.elf File opened for reading /proc/746/fd x86.elf File opened for reading /proc/76/fd x86.elf File opened for reading /proc/263/fd x86.elf File opened for reading /proc/551/fd x86.elf File opened for reading /proc/742/fd x86.elf File opened for reading /proc/18/fd x86.elf File opened for reading /proc/78/fd x86.elf File opened for reading /proc/99/fd x86.elf File opened for reading /proc/408/fd x86.elf File opened for reading /proc/412/fd x86.elf File opened for reading /proc/616/fd x86.elf File opened for reading /proc/7/fd x86.elf File opened for reading /proc/27/fd x86.elf File opened for reading /proc/202/fd x86.elf File opened for reading /proc/665/fd x86.elf File opened for reading /proc/5/fd x86.elf File opened for reading /proc/83/fd x86.elf File opened for reading /proc/102/fd x86.elf File opened for reading /proc/110/fd x86.elf File opened for reading /proc/113/fd x86.elf File opened for reading /proc/10/fd x86.elf File opened for reading /proc/20/fd x86.elf File opened for reading /proc/25/fd x86.elf File opened for reading /proc/21/fd x86.elf File opened for reading /proc/86/fd x86.elf File opened for reading /proc/8/fd x86.elf File opened for reading /proc/101/fd x86.elf File opened for reading /proc/635/fd x86.elf File opened for reading /proc/22/fd x86.elf