Analysis
-
max time kernel
0s -
max time network
0s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240611-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
13-12-2024 14:38
Behavioral task
behavioral1
Sample
.5r3fqt67ew531has4231.x86.elf
Resource
ubuntu2004-amd64-20240611-en
ubuntu-20.04-amd64
1 signatures
150 seconds
Errors
Reason
Payload did not run: exit status 2
General
-
Target
.5r3fqt67ew531has4231.x86.elf
-
Size
188KB
-
MD5
f36384e2b7c2d7c678c3967def352585
-
SHA1
459d26cf4798be72dd7a927efb7d4b6ffb9ef1c2
-
SHA256
25e4015ef827f43fd5987f172c04607f6a1934eda51443630476ed6184fe0f16
-
SHA512
65494f406ed60fa0f2cedeac032c9305d7bf110e0549a16d55a30dafcf27019ea5051c63f0cb740e66047da5a558e130a5bcb5e429c82370451c6d99db06da93
-
SSDEEP
3072:3sytfI/tjC/g53X6jLaWwzx7LgtkpLIoglNP27Tt3EwbZnm:XIpC/g53KjLaWw+V/mEwRm
Score
7/10
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1402 sh
Processes
-
/tmp/.5r3fqt67ew531has4231.x86.elf/tmp/.5r3fqt67ew531has4231.x86.elf1⤵PID:1401
-
/bin/shsh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/.5r3fqt67ew531has4231.x86.elf bin/busybox; chmod 777 bin/busybox"2⤵
- File and Directory Permissions Modification
PID:1402 -
/usr/bin/rmrm -rf bin/busybox3⤵PID:1403
-
-