Overview

overview

6

Static

static

1

2251bc7910...cf.elf

ubuntu-24.04-amd64

6

Analysis

  • max time kernel
    2s
  • max time network
    133s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    21/11/2024, 11:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2251bc7910fe46fd0baf8bc05599bdcf.elf
  • Size 190KB
  • Sample241121-m9pkgasclr
  • SHA256 cff20753e36a4c942dc4dab5a91fd621a42330e17a89185a5b7262280bcd9263
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10
antivmdiscoveryevasionexecutionpersistence

Malware Config

Signatures

  • Reads list of loaded kernel modules 1 TTPs 1 IoCs

    Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

    evasion
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Creates .desktop file 2 TTPs 1 IoCs

    Linux desktops like GNOME require .desktop files to register applications. Sometimes abused by malware for persistence.

    persistenceexecution
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 8 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/2251bc7910fe46fd0baf8bc05599bdcf.elf
    /tmp/2251bc7910fe46fd0baf8bc05599bdcf.elf
    1⤵
    • Creates .desktop file
    • Writes file to tmp directory
    PID:2577
    • /bin/sh
      sh -c -- hostname
      2⤵
        PID:2579
        • /usr/bin/hostname
          hostname
          3⤵
            PID:2580
        • /bin/sh
          sh -c -- whoami
          2⤵
            PID:2581
            • /usr/bin/whoami
              whoami
              3⤵
                PID:2582
            • /bin/sh
              sh -c -- "cat /proc/cpuinfo | grep \"model name\""
              2⤵
                PID:2583
                • /usr/bin/cat
                  cat /proc/cpuinfo
                  3⤵
                  • Checks CPU configuration
                  PID:2584
                • /usr/bin/grep
                  grep "model name"
                  3⤵
                  • Reads runtime system information
                  PID:2585
              • /bin/sh
                sh -c -- "df -h|grep 'dev' |grep -v none|awk '/dev/{print \$6}'"
                2⤵
                  PID:2586
                  • /usr/bin/df
                    df -h
                    3⤵
                    • Reads runtime system information
                    PID:2587
                  • /usr/bin/grep
                    grep dev
                    3⤵
                    • Reads runtime system information
                    PID:2588
                  • /usr/bin/grep
                    grep -v none
                    3⤵
                    • Reads runtime system information
                    PID:2589
                  • /usr/bin/awk
                    awk "/dev/{print \$6}"
                    3⤵
                    • Reads runtime system information
                    PID:2590
                • /bin/sh
                  sh -c -- "uname -r"
                  2⤵
                    PID:2591
                    • /usr/bin/uname
                      uname -r
                      3⤵
                        PID:2592
                    • /bin/sh
                      sh -c -- "uname -r"
                      2⤵
                        PID:2597
                        • /usr/bin/uname
                          uname -r
                          3⤵
                            PID:2598
                        • /bin/sh
                          sh -c -- "rmmod usbdev.ko 2>/dev/null"
                          2⤵
                            PID:2599
                            • /usr/sbin/rmmod
                              rmmod usbdev.ko
                              3⤵
                              • Reads runtime system information
                              PID:2600
                          • /bin/sh
                            sh -c -- "rm -rf ../lib/usbdev.ko"
                            2⤵
                              PID:2601
                              • /usr/bin/rm
                                rm -rf ../lib/usbdev.ko
                                3⤵
                                  PID:2602
                              • /bin/sh
                                sh -c -- "lsmod | grep usbdev"
                                2⤵
                                  PID:2604
                                  • /usr/sbin/lsmod
                                    lsmod
                                    3⤵
                                    • Reads list of loaded kernel modules
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:2605
                                  • /usr/bin/grep
                                    grep usbdev
                                    3⤵
                                    • Reads runtime system information
                                    PID:2606

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    gnome-control.desktop
                                    • Path /root/.config/autostart/gnome-control.desktop
                                    • Size 185B
                                    • SHA256 209bcb606caffd2f4c35f7a5efedb081d1ea0758d0d2e992c6706c66d227c092
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    pid
                                    • Path /tmp/pid
                                    • Size 5B
                                    • SHA256 3446c59031d7c96ce3b7749ad91b699a2f37de93f03c58ec4414582384a131d6
                                    • MD5 SHA1 SHA512
                                    Submit Download