Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
26-12-2024 02:19
Behavioral task
behavioral1
Sample
71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
2 signatures
150 seconds
General
-
Target
71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf
-
Size
61KB
-
MD5
6c810013c99f6d43ad7bfe3fccc6a51c
-
SHA1
8b88911c526ab2beba9db5a68b31c98c26fd4e2a
-
SHA256
71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa
-
SHA512
a86e5f10a4c4dc5485f72480dd9d3786a7eb003d1428d918f81db64c1e7050ac4108b431a0bb7685d3a444faf95ef9d420d4d7a12decab360c787f50413a4840
-
SSDEEP
1536:MOf6FP7mQT9+CgAf92NJcJjbRUbPqadvPcifVd7c/4CSQP:ff6BaQT9+EMc1b2TqIPfn7q
Score
7/10
Malware Config
Signatures
-
Loads a kernel module 46 IoCs
Loads a Linux kernel module, potentially to achieve persistence
pid Process 2819 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf 2820 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/httpd 71504c9ebaec8c03e24dd0e3c504c9c37c4c4aef70f5ba7f0a66e127e365e7fa.elf