Analysis
-
max time kernel
7s -
max time network
34s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
09-12-2024 18:32
General
-
Target
Fantazy.x86.elf
-
Size
68KB
-
MD5
56e53d695c841e581df815c0725b8855
-
SHA1
ec60dad1388ec1044b808a22791f794c1915f618
-
SHA256
f6992e9d2b62dd14a27078268f8f3182d10930b63eb6d3f8a704178c1fcc3ab0
-
SHA512
f7825a1c2e3dec98245b16002db1781a3205d1936553fa4c5dbb2b2622716941b757dfac135efc282f629d331b3cf91bcdc117f72ae33d97ce242b248d6514f6
-
SSDEEP
1536:mOhjXtM7ayXRulHeEqPZTSBLDi8eKvJ3rw0hc1g4:mkXO7ayUJeEmZTSxD9eKvF8Qc1g
Score
8/10
Malware Config
Signatures
-
Contacts a large (1121) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Loads a kernel module 8 IoCs
Loads a Linux kernel module, potentially to achieve persistence
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/Fantazy.x86.elf/tmp/Fantazy.x86.elf1⤵
- Loads a kernel module
- Writes file to tmp directory