Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    03-12-2024 20:51

General

  • Target

    teste.x86.elf

  • Size

    108KB

  • MD5

    8e5a6c67581db35245a580f3e6900961

  • SHA1

    b8db9ab9b233d45dc365d3436f47d534fc3a5429

  • SHA256

    b635d47afb00cd7dcc1a32c5ac9307c064be3918c230ae7c95e7f653a29c5f20

  • SHA512

    6b204426a4c01000b93ef35812507fd9377949d8ddc0340d9a3d1b697881aa863c55a2c9ed67a19c0b6e7367fc2223b67e4134cd52e5b689cc79e00d4dfcaba1

  • SSDEEP

    1536:JvumDCpfSvaRyqTI1eNQ+OA8MtP44JoFD1a56Lz3mCLtCcnJbSq2QkkHIJv:gP6vaRX6eNQA8K44+F5YQ3ntxJ2HkHI

Malware Config

Signatures

  • Contacts a large (76758) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 2 IoCs
  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/teste.x86.elf
    /tmp/teste.x86.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Changes its process name
    • Reads runtime system information
    PID:1584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads