Analysis
-
max time kernel
130s -
max time network
136s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240729-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
31-12-2024 02:12
Behavioral task
behavioral1
Sample
rjnven64.elf
Resource
ubuntu2404-amd64-20240729-en
ubuntu-24.04-amd64
4 signatures
150 seconds
General
-
Target
rjnven64.elf
-
Size
164KB
-
MD5
7c28e1ea541327cad32db77941bdc9a4
-
SHA1
06c664686fe8c7cda4f4f665e3c2b888f21c5dc4
-
SHA256
3b57990874af476bd1f59cb4bcb4fc31f95d8faeda1e57c1a73616bc21fae7c3
-
SHA512
c593d47ff26532cb3ecbd965da0549dd59fdb3d5a9d663ab032ea90ec7591d3b05508e317317a65af279ad7e6dffa9d59bbeefdd4668f0d0f631b3675efc4869
-
SSDEEP
3072:Lm9vRQaLBVxFt4xmjjINVreJQjz/dlKB/rPVyOivmFHxtLNsDVzLG/hc:LmNRQaLBDFt4sjIN0UG7XFGVPG/h
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2508 rjnven64.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 2507 rjnven64.elf -
description ioc Process File opened for reading /proc/1255/cmdline rjnven64.elf File opened for reading /proc/1919/cmdline rjnven64.elf File opened for reading /proc/27/cmdline rjnven64.elf File opened for reading /proc/44/cmdline rjnven64.elf File opened for reading /proc/47/cmdline rjnven64.elf File opened for reading /proc/810/cmdline rjnven64.elf File opened for reading /proc/1122/cmdline rjnven64.elf File opened for reading /proc/1081/cmdline rjnven64.elf File opened for reading /proc/21/cmdline rjnven64.elf File opened for reading /proc/25/cmdline rjnven64.elf File opened for reading /proc/191/cmdline rjnven64.elf File opened for reading /proc/389/cmdline rjnven64.elf File opened for reading /proc/785/cmdline rjnven64.elf File opened for reading /proc/6/cmdline rjnven64.elf File opened for reading /proc/39/cmdline rjnven64.elf File opened for reading /proc/192/cmdline rjnven64.elf File opened for reading /proc/200/cmdline rjnven64.elf File opened for reading /proc/1045/cmdline rjnven64.elf File opened for reading /proc/1815/cmdline rjnven64.elf File opened for reading /proc/1860/cmdline rjnven64.elf File opened for reading /proc/31/cmdline rjnven64.elf File opened for reading /proc/41/cmdline rjnven64.elf File opened for reading /proc/19/cmdline rjnven64.elf File opened for reading /proc/432/cmdline rjnven64.elf File opened for reading /proc/1798/cmdline rjnven64.elf File opened for reading /proc/1972/cmdline rjnven64.elf File opened for reading /proc/1054/cmdline rjnven64.elf File opened for reading /proc/1714/cmdline rjnven64.elf File opened for reading /proc/1724/cmdline rjnven64.elf File opened for reading /proc/28/cmdline rjnven64.elf File opened for reading /proc/34/cmdline rjnven64.elf File opened for reading /proc/71/cmdline rjnven64.elf File opened for reading /proc/196/cmdline rjnven64.elf File opened for reading /proc/338/cmdline rjnven64.elf File opened for reading /proc/52/cmdline rjnven64.elf File opened for reading /proc/124/cmdline rjnven64.elf File opened for reading /proc/199/cmdline rjnven64.elf File opened for reading /proc/23/cmdline rjnven64.elf File opened for reading /proc/201/cmdline rjnven64.elf File opened for reading /proc/811/cmdline rjnven64.elf File opened for reading /proc/1695/cmdline rjnven64.elf File opened for reading /proc/1936/cmdline rjnven64.elf File opened for reading /proc/772/cmdline rjnven64.elf File opened for reading /proc/1965/cmdline rjnven64.elf File opened for reading /proc/1980/cmdline rjnven64.elf File opened for reading /proc/587/cmdline rjnven64.elf File opened for reading /proc/777/cmdline rjnven64.elf File opened for reading /proc/784/cmdline rjnven64.elf File opened for reading /proc/1339/cmdline rjnven64.elf File opened for reading /proc/1983/cmdline rjnven64.elf File opened for reading /proc/418/cmdline rjnven64.elf File opened for reading /proc/755/cmdline rjnven64.elf File opened for reading /proc/1068/cmdline rjnven64.elf File opened for reading /proc/15/cmdline rjnven64.elf File opened for reading /proc/36/cmdline rjnven64.elf File opened for reading /proc/67/cmdline rjnven64.elf File opened for reading /proc/195/cmdline rjnven64.elf File opened for reading /proc/198/cmdline rjnven64.elf File opened for reading /proc/45/cmdline rjnven64.elf File opened for reading /proc/275/cmdline rjnven64.elf File opened for reading /proc/765/cmdline rjnven64.elf File opened for reading /proc/1964/cmdline rjnven64.elf File opened for reading /proc/13/cmdline rjnven64.elf File opened for reading /proc/18/cmdline rjnven64.elf