Analysis
-
max time kernel
149s -
max time network
149s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
28-11-2024 02:14
Static task
static1
Behavioral task
behavioral1
Sample
17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf
-
Size
141KB
-
MD5
da58289be6761af8b39e4c9fbd3d1dbc
-
SHA1
ba011598b29ddb7fe3d11c1725e1a6e7ef6cdf33
-
SHA256
17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57
-
SHA512
5ae97ad79d003b2f4dde0b1b905b12338ab2755b7c5d5434195ab5971cc123c31555dca9c389d3f31cbc9b836070d190b081c94c27c6b5fbd5e33a3a8091e8d5
-
SSDEEP
3072:myLCpsoIEtrhrjJZEvjjk3UaogYykEbpaeDdzrmt1F:myLCpsoIEtrUNUb96F
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M " 1465 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf -
description ioc Process File opened for reading /proc/32/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/35/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1195/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1269/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1325/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/20/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/699/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1144/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/169/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/197/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/163/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/154/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/451/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/638/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1070/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1090/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1133/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1463/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/84/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/166/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/506/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/513/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1129/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1232/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1309/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1355/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/85/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/22/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/89/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/167/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/168/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/544/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1130/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/5/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1028/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/25/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/26/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/130/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/9/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/24/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/80/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/442/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/457/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/652/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/949/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1112/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/4/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1156/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/7/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/29/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/78/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/157/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/160/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/645/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1116/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/3/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1162/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/331/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/857/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1022/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/196/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/81/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1166/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf File opened for reading /proc/1462/cmdline 17eae48b524af62595052f8854e14d1c9271aae36375f75fdeb6a940ead77f57.elf