Analysis
-
max time kernel
149s -
max time network
149s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
24-12-2024 01:06
Behavioral task
behavioral1
Sample
3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf
Resource
ubuntu2204-amd64-20240611-en
General
-
Target
3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf
-
Size
64KB
-
MD5
2354f2531c0bf296738fa7733c42785f
-
SHA1
86508e4ee74c70bf226f6666bf227a12be69dcad
-
SHA256
3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93
-
SHA512
eda30463d2e8355af4d6626815aedb78b1b5d43c4df53e4a9a72405074a22e9fd09f54e882b0c5ad5136202907a7e6e599d29d325d6e0b3188e6f8ff77abe679
-
SSDEEP
1536:IoRC9170vwHbQXZ5+qXDEuXi90dSW7V/DjObeFt6PuQ4Zc:PC917iwHbQXZ5+qXA594SWZ/XObeb6G7
Malware Config
Signatures
-
Contacts a large (20172) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for modification /dev/misc/watchdog 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf -
description ioc Process File opened for reading /proc/665/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1032/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/948/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1057/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1284/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1037/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1214/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1103/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/520/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/774/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/634/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/586/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/937/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1175/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1175/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1307/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1159/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1244/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/971/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1096/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1449/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1052/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1343/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/417/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/613/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/614/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/788/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1280/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/452/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1143/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1166/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/775/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1000/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1078/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1037/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1562/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/809/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/972/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1112/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1563/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/590/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1052/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1253/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/586/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/635/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1420/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/636/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1189/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1577/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1284/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1253/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1374/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/723/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/723/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/736/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1382/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/594/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/635/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1172/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1157/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1172/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/809/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/1449/exe 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf File opened for reading /proc/636/fd 3d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93.elf