Analysis
-
max time kernel
10s -
max time network
11s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
14-12-2024 12:12
Behavioral task
behavioral1
Sample
TRC.x86
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
6 signatures
150 seconds
General
-
Target
TRC.x86
-
Size
72KB
-
MD5
d36df8c6196d7a1a69f19fca0a920c21
-
SHA1
784d3ad8de8e14e06a592fa856b5c5c421841dfc
-
SHA256
524eed0cc5e16a7d26efb46ce9d09641470c2db156d69558270f0c9de0271c2f
-
SHA512
3d834bd5b484a71aaabcd7d5ef004d4a271ba801c320741adcfa1885c0ac5d554dd2d955d9b102e347b0acc32cf0c9c4d86af1322916e7612a36c26a16f3a10c
-
SSDEEP
1536:gEKGADH0fCgPVB/ZzNmevvUdSu/4SWof/dYP7dsotiImlK:TKTDUfCcVBhkwvUdSuASWe/kxsoYIyK
Score
8/10
Malware Config
Signatures
-
Contacts a large (1504) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog TRC.x86 File opened for modification /dev/misc/watchdog TRC.x86 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp TRC.x86 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp TRC.x86 -
description ioc Process File opened for reading /proc/1063/fd TRC.x86 File opened for reading /proc/1152/fd TRC.x86 File opened for reading /proc/1167/fd TRC.x86 File opened for reading /proc/1224/fd TRC.x86 File opened for reading /proc/1523/fd TRC.x86 File opened for reading /proc/1561/fd TRC.x86 File opened for reading /proc/766/fd TRC.x86 File opened for reading /proc/774/fd TRC.x86 File opened for reading /proc/1577/fd TRC.x86 File opened for reading /proc/760/fd TRC.x86 File opened for reading /proc/1425/fd TRC.x86 File opened for reading /proc/1230/fd TRC.x86 File opened for reading /proc/1335/fd TRC.x86 File opened for reading /proc/613/fd TRC.x86 File opened for reading /proc/967/fd TRC.x86 File opened for reading /proc/936/fd TRC.x86 File opened for reading /proc/1154/fd TRC.x86 File opened for reading /proc/1/fd TRC.x86 File opened for reading /proc/609/fd TRC.x86 File opened for reading /proc/1158/fd TRC.x86 File opened for reading /proc/1370/fd TRC.x86 File opened for reading /proc/1234/fd TRC.x86 File opened for reading /proc/1572/fd TRC.x86 File opened for reading /proc/782/fd TRC.x86 File opened for reading /proc/1043/fd TRC.x86 File opened for reading /proc/1247/fd TRC.x86 File opened for reading /proc/588/fd TRC.x86 File opened for reading /proc/1049/fd TRC.x86 File opened for reading /proc/1037/fd TRC.x86 File opened for reading /proc/1113/fd TRC.x86 File opened for reading /proc/1446/fd TRC.x86 File opened for reading /proc/426/fd TRC.x86 File opened for reading /proc/979/fd TRC.x86 File opened for reading /proc/1202/fd TRC.x86 File opened for reading /proc/454/fd TRC.x86 File opened for reading /proc/633/fd TRC.x86 File opened for reading /proc/747/fd TRC.x86 File opened for reading /proc/1433/fd TRC.x86 File opened for reading /proc/1156/fd TRC.x86 File opened for reading /proc/1574/fd TRC.x86 File opened for reading /proc/651/fd TRC.x86 File opened for reading /proc/758/fd TRC.x86 File opened for reading /proc/789/fd TRC.x86 File opened for reading /proc/1082/fd TRC.x86 File opened for reading /proc/1161/fd TRC.x86 File opened for reading /proc/1166/fd TRC.x86 File opened for reading /proc/543/fd TRC.x86 File opened for reading /proc/585/fd TRC.x86 File opened for reading /proc/1168/fd TRC.x86 File opened for reading /proc/678/fd TRC.x86 File opened for reading /proc/1153/fd TRC.x86 File opened for reading /proc/1093/fd TRC.x86 File opened for reading /proc/1292/fd TRC.x86 File opened for reading /proc/636/fd TRC.x86 File opened for reading /proc/787/fd TRC.x86 File opened for reading /proc/1091/fd TRC.x86 File opened for reading /proc/1358/fd TRC.x86 File opened for reading /proc/1367/fd TRC.x86 File opened for reading /proc/589/fd TRC.x86 File opened for reading /proc/946/fd TRC.x86 File opened for reading /proc/1155/fd TRC.x86 File opened for reading /proc/1295/fd TRC.x86 File opened for reading /proc/1032/fd TRC.x86 File opened for reading /proc/1162/fd TRC.x86