b66cb602de230f940ec42ae228e3c8a6729223352c477f8d57b2c2a3ef865b7f

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240729-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
30-12-2024 10:43

Target

vcimanagement.i586.elf
Size

103KB
MD5

a3ff568c85a9828ab5a551178974baca
SHA1

c7a1d2747b42863e37f7d345244e28944d2e1373
SHA256

b66cb602de230f940ec42ae228e3c8a6729223352c477f8d57b2c2a3ef865b7f
SHA512

bd96b44b1e518ffacd46212482af87aa8bfa8d2205b341fefb37f53f6731a9a1e4238313465a6f281042b3c528bca110507e87ec7f021002bc80d14cb8b9824b
SSDEEP

3072:jvpdjSam6pRTU7F5b6o4eA+BR8QhDCOiMRIDLoE4gqXaah84:jvpcam6pdgnb6oTAeb8OiwIDLoE4gqXn

Score

9^/10

discovery rootkit

Contacts a large (23838) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Loads a kernel module 48 IoCs

Loads a Linux kernel module, potentially to achieve persistence

/tmp/vcimanagement.i586.elf
/tmp/vcimanagement.i586.elf
1⤵
- Loads a kernel module
PID:2509

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact