Analysis
-
max time kernel
149s -
max time network
153s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20241127-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20241127-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
04-12-2024 03:02
Static task
static1
Behavioral task
behavioral1
Sample
a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf
Resource
ubuntu2004-amd64-20241127-en
ubuntu-20.04-amd64
3 signatures
150 seconds
General
-
Target
a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf
-
Size
91KB
-
MD5
145e29253bfc664e43dd7bab8dfe6845
-
SHA1
2c4ea99bb8eba430420c8f195e158612e846fd63
-
SHA256
a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d
-
SHA512
b118983d1fc1907b979286b988d42b45f7b6e82ab771fac298deb0289f482f045f1653e098092031d38f79651f54324d74e8d61f5d9ee3a9f7ac968432d692da
-
SSDEEP
1536:a3FPOoCgCO0GRWBqRnrVMlixg2MxvwICz9tCD48PAHHS+SOFGRAEeM:cFPjC9O0GRUqRJMlixg20ng9C4QaynOq
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1389 a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf -
description ioc Process File opened for reading /proc/1335/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/666/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1179/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1331/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/70/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1454/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1475/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1101/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1468/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1470/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/88/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/456/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/494/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/74/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/998/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/20/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1006/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1390/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1410/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1452/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/170/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/313/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1386/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1469/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/14/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1346/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1461/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/824/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/875/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1203/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1447/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1451/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/84/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/165/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/637/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/442/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/473/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1118/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/273/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/803/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/174/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1336/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1337/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1441/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/200/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/751/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1128/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1330/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1433/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1455/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/11/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/91/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/455/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/668/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1104/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/90/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/264/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/613/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1340/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1460/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1466/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/79/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/768/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf File opened for reading /proc/1043/cmdline a495a3c3c3683bb7d823518018bb98c6a71a962c134e33ede9ab8e683c6dcd4d.elf