Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
10-12-2024 17:02
Behavioral task
behavioral1
Sample
rebirth.dbg.elf
Resource
ubuntu2204-amd64-20240611-en
General
-
Target
rebirth.dbg.elf
-
Size
73KB
-
MD5
3b144730f38371b45d921f2ae5523589
-
SHA1
e91c857f7e377c05b3584ff14a151b074f1a8604
-
SHA256
2fee0a938d98883e12a66ab95af6e8dbadf8c045a7ebc69dc87e19c56e67b9d5
-
SHA512
2bd2d4daa187d752d856f72a5975ed888c107eeac2042d23a1beee1133deb546df3029ff042d73b8fafd2a350a5ae086e49295537bd6d1227cf795a7a8f74d13
-
SSDEEP
1536:Fyjn5NDwpzW4xUxdGt/qqzZmwV7/UXphLpYGBVPY409s0wbZnl:oj5NDOiGUxmhZm67/OhlBVPY4cwbZnl
Malware Config
Signatures
-
Contacts a large (82756) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1590 sh 1594 chmod -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /bin/systemd 1589 rebirth.dbg.elf -
description ioc Process File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mv -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/bin/systemd sh
Processes
-
/tmp/rebirth.dbg.elf/tmp/rebirth.dbg.elf1⤵
- Changes its process name
PID:1589 -
/bin/shsh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/rebirth.dbg.elf bin/systemd; chmod 777 bin/systemd"2⤵
- File and Directory Permissions Modification
- Writes file to tmp directory
PID:1590 -
/usr/bin/rmrm -rf bin/systemd3⤵PID:1591
-
-
/usr/bin/mkdirmkdir bin3⤵
- Reads runtime system information
PID:1592
-
-
/usr/bin/mvmv /tmp/rebirth.dbg.elf bin/systemd3⤵
- Reads runtime system information
PID:1593
-
-
/usr/bin/chmodchmod 777 bin/systemd3⤵
- File and Directory Permissions Modification
PID:1594
-
-