42887360eadb0f439745caaf2eb0a1767405c7b2541c9e45cef532580b8e46ee

Analysis

max time kernel
0s
max time network
128s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
29-12-2024 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x86_64.elf
Size

100KB
MD5

43d9d036cb3a5aab6154e8740f9d6ece
SHA1

3735d09ba41944ba8d873c2f704d22297b0222fc
SHA256

42887360eadb0f439745caaf2eb0a1767405c7b2541c9e45cef532580b8e46ee
SHA512

bbcad62c040b6af840f4b20a555a0418d2f37b68521475fbd0af940a7415034f4778aa3deb96e52b4cec9db95435a887e89059eaed5c7b1e24d246409e1a9289
SSDEEP

3072:2d2nDFe2oeLOOtJYyhAD3rZSrsphaiepTmHyVQX5A+u+cm:vqyhQ7phaieRmHyVQX5A+u+cm

Score

7^/10

Malware Config

Signatures

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/resolv.conf	x86_64.elf

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1571	x86_64.elf

/tmp/x86_64.elf
/tmp/x86_64.elf
1⤵
- Writes DNS configuration
- Changes its process name
PID:1571

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Adversary-in-the-Middle

T1557

Discovery

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads