Analysis
-
max time kernel
105s -
max time network
152s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
-
submitted
06-12-2024 01:39
General
-
Target
850ad30ed11c0f85a765d44c2074b83b61bd40ccfd137b799048271131280ff5.elf
-
Size
124KB
-
MD5
974d5a37d11bea6f546853bcf6a23a13
-
SHA1
0bbdfa4266ae61c3982940bc06e370d882fb06b0
-
SHA256
850ad30ed11c0f85a765d44c2074b83b61bd40ccfd137b799048271131280ff5
-
SHA512
d3dd2f02e46ad35d85853ce33970aa641df3b6aea8ce004c260083215bb49b9186f9b558dbd313043e7ea25474802839d506210e39eb36fce49cceb52eb9346b
-
SSDEEP
3072:QbqCkOz3UoA0iCHWB+yGe6vK+hcDLoY4giAGaJpP:QbqCVpAj53IvK8cDLoY4giAGaJpP
Malware Config
Signatures
-
Contacts a large (69888) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/850ad30ed11c0f85a765d44c2074b83b61bd40ccfd137b799048271131280ff5.elf/tmp/850ad30ed11c0f85a765d44c2074b83b61bd40ccfd137b799048271131280ff5.elf1⤵
- Modifies Watchdog functionality
- Reads system routing table
- Changes its process name
- Reads system network configuration