Malware Analysis Report

2024-12-07 13:56

Sample ID 241118-dcp1aswmaz
Target ed6578f1c3f4cfd727f4fb467af0b4bb21436450f3a89df7993f96a01ab7b2bd.elf
SHA256 ed6578f1c3f4cfd727f4fb467af0b4bb21436450f3a89df7993f96a01ab7b2bd
Tags
rootkit
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

ed6578f1c3f4cfd727f4fb467af0b4bb21436450f3a89df7993f96a01ab7b2bd

Threat Level: Shows suspicious behavior

The file ed6578f1c3f4cfd727f4fb467af0b4bb21436450f3a89df7993f96a01ab7b2bd.elf was found to be: Shows suspicious behavior.

Malicious Activity Summary

rootkit

Loads a kernel module

Writes file to tmp directory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-11-18 02:52

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-18 02:52

Reported

2024-11-18 02:55

Platform

ubuntu2404-amd64-20240523-en

Max time kernel

149s

Max time network

137s

Command Line

[/tmp/ed6578f1c3f4cfd727f4fb467af0b4bb21436450f3a89df7993f96a01ab7b2bd.elf]

Signatures

Writes file to tmp directory

Description Indicator Process Target
File opened for modification /tmp/httpd /tmp/ed6578f1c3f4cfd727f4fb467af0b4bb21436450f3a89df7993f96a01ab7b2bd.elf N/A

Processes

/tmp/ed6578f1c3f4cfd727f4fb467af0b4bb21436450f3a89df7993f96a01ab7b2bd.elf

[/tmp/ed6578f1c3f4cfd727f4fb467af0b4bb21436450f3a89df7993f96a01ab7b2bd.elf]

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 ragebotnet.duckdns.org udp
DE 161.97.175.164:1995 ragebotnet.duckdns.org tcp

Files

N/A