Overview

overview

10

Static

static

10

f773d4c417...21.elf

ubuntu-24.04-amd64

9

Analysis

  • max time kernel
    134s
  • max time network
    150s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    17-12-2024 05:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f773d4c417f000b9d5a5e1a1829d46cb9be56cfd6d466bfb77ceced5deab8621.elf

  • Size

    69KB

  • MD5

    b72d8c3dc38b3d4d692b41bbc72d54b0

  • SHA1

    b7e586a17798966092453f3492d2a94e850efc46

  • SHA256

    f773d4c417f000b9d5a5e1a1829d46cb9be56cfd6d466bfb77ceced5deab8621

  • SHA512

    b887f9bbdc50ae3a1f058219deaccf95ee935ddb8b2225c20806a7adaf9ef018a6d1c4bcc231b3069056b5da1f2b10f4ff424aea63362bd092fa7fcb4a9c65e4

  • SSDEEP

    1536:pnUQJZdRlDAXO6QyQwOaOAOJxsxhP2J7RvsuIr5bh58s:pnUQJ7RlUXTQpwOaOAIxsTPC+uWgs

Score
9/10
discoveryrootkit

Malware Config

Signatures

  • Contacts a large (38141) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Loads a kernel module 36 IoCs

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit
  • Writes file to system bin folder 1 IoCs

Processes

  • /tmp/f773d4c417f000b9d5a5e1a1829d46cb9be56cfd6d466bfb77ceced5deab8621.elf
    /tmp/f773d4c417f000b9d5a5e1a1829d46cb9be56cfd6d466bfb77ceced5deab8621.elf
    1⤵
    • Loads a kernel module
    • Writes file to system bin folder
    PID:2454

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads