Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
03-12-2024 20:51
Behavioral task
behavioral1
Sample
teste.x86.elf
Resource
ubuntu2204-amd64-20240611-en
General
-
Target
teste.x86.elf
-
Size
108KB
-
MD5
8e5a6c67581db35245a580f3e6900961
-
SHA1
b8db9ab9b233d45dc365d3436f47d534fc3a5429
-
SHA256
b635d47afb00cd7dcc1a32c5ac9307c064be3918c230ae7c95e7f653a29c5f20
-
SHA512
6b204426a4c01000b93ef35812507fd9377949d8ddc0340d9a3d1b697881aa863c55a2c9ed67a19c0b6e7367fc2223b67e4134cd52e5b689cc79e00d4dfcaba1
-
SSDEEP
1536:JvumDCpfSvaRyqTI1eNQ+OA8MtP44JoFD1a56Lz3mCLtCcnJbSq2QkkHIJv:gP6vaRX6eNQA8K44+F5YQ3ntxJ2HkHI
Malware Config
Signatures
-
Contacts a large (76758) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog teste.x86.elf File opened for modification /dev/misc/watchdog teste.x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog teste.x86.elf File opened for modification /bin/watchdog teste.x86.elf -
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1584 teste.x86.elf -
description ioc Process File opened for reading /proc/2/cmdline teste.x86.elf File opened for reading /proc/15/cmdline teste.x86.elf File opened for reading /proc/1120/cmdline teste.x86.elf File opened for reading /proc/1306/cmdline teste.x86.elf File opened for reading /proc/408/cmdline teste.x86.elf File opened for reading /proc/628/cmdline teste.x86.elf File opened for reading /proc/8/cmdline teste.x86.elf File opened for reading /proc/10/cmdline teste.x86.elf File opened for reading /proc/16/cmdline teste.x86.elf File opened for reading /proc/213/cmdline teste.x86.elf File opened for reading /proc/1418/cmdline teste.x86.elf File opened for reading /proc/1588/cmdline teste.x86.elf File opened for reading /proc/523/cmdline teste.x86.elf File opened for reading /proc/752/cmdline teste.x86.elf File opened for reading /proc/952/cmdline teste.x86.elf File opened for reading /proc/1180/cmdline teste.x86.elf File opened for reading /proc/1396/cmdline teste.x86.elf File opened for reading /proc/1572/cmdline teste.x86.elf File opened for reading /proc/80/cmdline teste.x86.elf File opened for reading /proc/223/cmdline teste.x86.elf File opened for reading /proc/311/cmdline teste.x86.elf File opened for reading /proc/1095/cmdline teste.x86.elf File opened for reading /proc/1360/cmdline teste.x86.elf File opened for reading /proc/75/cmdline teste.x86.elf File opened for reading /proc/221/cmdline teste.x86.elf File opened for reading /proc/605/cmdline teste.x86.elf File opened for reading /proc/967/cmdline teste.x86.elf File opened for reading /proc/599/cmdline teste.x86.elf File opened for reading /proc/1049/cmdline teste.x86.elf File opened for reading /proc/1154/cmdline teste.x86.elf File opened for reading /proc/1284/cmdline teste.x86.elf File opened for reading /proc/90/cmdline teste.x86.elf File opened for reading /proc/101/cmdline teste.x86.elf File opened for reading /proc/225/cmdline teste.x86.elf File opened for reading /proc/497/cmdline teste.x86.elf File opened for reading /proc/1401/cmdline teste.x86.elf File opened for reading /proc/1277/cmdline teste.x86.elf File opened for reading /proc/5/cmdline teste.x86.elf File opened for reading /proc/218/cmdline teste.x86.elf File opened for reading /proc/589/cmdline teste.x86.elf File opened for reading /proc/764/cmdline teste.x86.elf File opened for reading /proc/1138/cmdline teste.x86.elf File opened for reading /proc/1593/cmdline teste.x86.elf File opened for reading /proc/12/cmdline teste.x86.elf File opened for reading /proc/644/cmdline teste.x86.elf File opened for reading /proc/1045/cmdline teste.x86.elf File opened for reading /proc/1127/cmdline teste.x86.elf File opened for reading /proc/1032/cmdline teste.x86.elf File opened for reading /proc/3/cmdline teste.x86.elf File opened for reading /proc/11/cmdline teste.x86.elf File opened for reading /proc/17/cmdline teste.x86.elf File opened for reading /proc/91/cmdline teste.x86.elf File opened for reading /proc/1404/cmdline teste.x86.elf File opened for reading /proc/1498/cmdline teste.x86.elf File opened for reading /proc/212/cmdline teste.x86.elf File opened for reading /proc/522/cmdline teste.x86.elf File opened for reading /proc/979/cmdline teste.x86.elf File opened for reading /proc/1191/cmdline teste.x86.elf File opened for reading /proc/691/cmdline teste.x86.elf File opened for reading /proc/1152/cmdline teste.x86.elf File opened for reading /proc/1291/cmdline teste.x86.elf File opened for reading /proc/1585/cmdline teste.x86.elf File opened for reading /proc/588/cmdline teste.x86.elf File opened for reading /proc/590/cmdline teste.x86.elf