Analysis
-
max time kernel
22s -
max time network
25s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
19-12-2024 15:48
Behavioral task
behavioral1
Sample
x86_64
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
-
Target
x86_64
-
Size
76KB
-
MD5
20298e228b90c88533efc7d574affdfb
-
SHA1
f42ea8d586accb5ce87f032e984f3661f567f31e
-
SHA256
f136e57f0012699ff8ca132a6f5ce47fb6f833cddb9124f234dac51709009734
-
SHA512
e11c7913a23c3c1739fc7e89cc835ae38ccc1073f07a7c0667cad70878691deb3b7318539d6140c0ce4927527a4cfdcb8f2a378ca660bfb03a794958159e32ac
-
SSDEEP
1536:Yi1YUwiH1q2S+levBG+2U2hG90hCy2++Eg95YFVC6wAZ:YieGVq2S+0vBGa2cYn2+M95+C6wAZ
Score
9/10
Malware Config
Signatures
-
Contacts a large (7573) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog x86_64 File opened for modification /dev/watchdog x86_64 -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself oJusplSPNoKShjaW 1481 x86_64 -
description ioc Process File opened for reading /proc/1484/cmdline x86_64 File opened for reading /proc/1166/cmdline x86_64 File opened for reading /proc/1319/cmdline x86_64 File opened for reading /proc/1476/cmdline x86_64 File opened for reading /proc/1479/cmdline x86_64 File opened for reading /proc/1121/cmdline x86_64 File opened for reading /proc/1182/cmdline x86_64 File opened for reading /proc/1285/cmdline x86_64 File opened for reading /proc/415/cmdline x86_64 File opened for reading /proc/485/cmdline x86_64 File opened for reading /proc/632/cmdline x86_64 File opened for reading /proc/662/cmdline x86_64 File opened for reading /proc/1370/cmdline x86_64 File opened for reading /proc/440/cmdline x86_64 File opened for reading /proc/441/cmdline x86_64 File opened for reading /proc/1017/cmdline x86_64 File opened for reading /proc/1194/cmdline x86_64 File opened for reading /proc/1129/cmdline x86_64 File opened for reading /proc/1148/cmdline x86_64 File opened for reading /proc/1168/cmdline x86_64 File opened for reading /proc/1331/cmdline x86_64 File opened for reading /proc/425/cmdline x86_64 File opened for reading /proc/451/cmdline x86_64 File opened for reading /proc/596/cmdline x86_64 File opened for reading /proc/650/cmdline x86_64 File opened for reading /proc/1485/cmdline x86_64 File opened for reading /proc/1491/cmdline x86_64 File opened for reading /proc/1239/cmdline x86_64 File opened for reading /proc/1308/cmdline x86_64 File opened for reading /proc/1488/cmdline x86_64 File opened for reading /proc/444/cmdline x86_64 File opened for reading /proc/712/cmdline x86_64 File opened for reading /proc/1186/cmdline x86_64 File opened for reading /proc/1229/cmdline x86_64 File opened for reading /proc/949/cmdline x86_64 File opened for reading /proc/968/cmdline x86_64 File opened for reading /proc/433/cmdline x86_64 File opened for reading /proc/518/cmdline x86_64 File opened for reading /proc/595/cmdline x86_64 File opened for reading /proc/934/cmdline x86_64 File opened for reading /proc/1125/cmdline x86_64 File opened for reading /proc/1162/cmdline x86_64 File opened for reading /proc/1188/cmdline x86_64 File opened for reading /proc/1348/cmdline x86_64 File opened for reading /proc/421/cmdline x86_64 File opened for reading /proc/468/cmdline x86_64 File opened for reading /proc/532/cmdline x86_64 File opened for reading /proc/867/cmdline x86_64 File opened for reading /proc/1065/cmdline x86_64 File opened for reading /proc/1134/cmdline x86_64 File opened for reading /proc/1303/cmdline x86_64 File opened for reading /proc/1482/cmdline x86_64 File opened for reading /proc/1097/cmdline x86_64 File opened for reading /proc/1143/cmdline x86_64 File opened for reading /proc/1151/cmdline x86_64 File opened for reading /proc/1165/cmdline x86_64 File opened for reading /proc/464/cmdline x86_64 File opened for reading /proc/962/cmdline x86_64 File opened for reading /proc/1041/cmdline x86_64 File opened for reading /proc/1061/cmdline x86_64 File opened for reading /proc/917/cmdline x86_64 File opened for reading /proc/462/cmdline x86_64 File opened for reading /proc/515/cmdline x86_64 File opened for reading /proc/652/cmdline x86_64