Analysis
-
max time kernel
148s -
max time network
152s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
22-11-2024 13:47
Static task
static1
Behavioral task
behavioral1
Sample
main_x86.elf
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
2 signatures
150 seconds
General
-
Target
main_x86.elf
-
Size
87KB
-
MD5
b1afe1bcd2829d5969c0f3b52d572c81
-
SHA1
6a27d10365bcfc960e2f7f952494b3bd399d0a8c
-
SHA256
3869489d81285d1123b6b6054f37021840f840e3313123c17a2ec79edf8ee2b0
-
SHA512
6a5ca1ee5e3f607c95e9e8843136cd7c1066c34830000d672d56ce43b7a77511024d2a79b6889b6029902814487590ff82b4c33cc77603c03a5a3f17d05aad0c
-
SSDEEP
1536:W/QCZaxGdvts3i5JPhogAxPu++AjloUIKqI4FrS4LSa:WYCZa8dvm3oJPh1AxP5JlKKfUmDa
Score
7/10
Malware Config
Signatures
-
Loads a kernel module 64 IoCs
Loads a Linux kernel module, potentially to achieve persistence
Processes:
main_x86.elfpid Process 2816 main_x86.elf 2816 main_x86.elf 2816 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf 2817 main_x86.elf -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
main_x86.elfdescription ioc Process File opened for modification /tmp/httpd main_x86.elf