Analysis
-
max time kernel
139s -
max time network
151s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
31/12/2024, 02:46
General
-
Target
a5ddb64df4b96bfeae6860981f98b4845df83db34ffaf238548bede6067f15c2.elf
-
Size
50KB
-
MD5
1092f7846a6ca7a5e92ece0ea93ff82e
-
SHA1
140fd3e84c49d382e6b0f9a40730d1cd465f8347
-
SHA256
a5ddb64df4b96bfeae6860981f98b4845df83db34ffaf238548bede6067f15c2
-
SHA512
11ba6cdfba1784d5f2895f351def8d6a4dc0d5efd56b735978d1ff7416d2a52da07931250f37311362c8d522f7db89e3ac8bf1de890302afa6281ce2a2f6b2ba
-
SSDEEP
768:ytYRSjaQ9DaZ/oJlExakbMqu8iz/nkvKy+hFlKTm/4RsvKQLDJCgMjz:WYRSjaCu1wlPbPly+hnKq/4G3LNCgMv
Score
9/10
Malware Config
Signatures
-
Contacts a large (56423) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Loads a kernel module 41 IoCs
Loads a Linux kernel module, potentially to achieve persistence
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/a5ddb64df4b96bfeae6860981f98b4845df83db34ffaf238548bede6067f15c2.elf/tmp/a5ddb64df4b96bfeae6860981f98b4845df83db34ffaf238548bede6067f15c2.elf1⤵
- Loads a kernel module
- Writes file to tmp directory