Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
-
submitted
31-12-2024 02:48
General
-
Target
b66cb602de230f940ec42ae228e3c8a6729223352c477f8d57b2c2a3ef865b7f.elf
-
Size
103KB
-
MD5
a3ff568c85a9828ab5a551178974baca
-
SHA1
c7a1d2747b42863e37f7d345244e28944d2e1373
-
SHA256
b66cb602de230f940ec42ae228e3c8a6729223352c477f8d57b2c2a3ef865b7f
-
SHA512
bd96b44b1e518ffacd46212482af87aa8bfa8d2205b341fefb37f53f6731a9a1e4238313465a6f281042b3c528bca110507e87ec7f021002bc80d14cb8b9824b
-
SSDEEP
3072:jvpdjSam6pRTU7F5b6o4eA+BR8QhDCOiMRIDLoE4gqXaah84:jvpcam6pdgnb6oTAeb8OiwIDLoE4gqXn
Malware Config
Signatures
-
Contacts a large (23838) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads process memory 1 TTPs 1 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 5 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/b66cb602de230f940ec42ae228e3c8a6729223352c477f8d57b2c2a3ef865b7f.elf/tmp/b66cb602de230f940ec42ae228e3c8a6729223352c477f8d57b2c2a3ef865b7f.elf1⤵
- Modifies Watchdog functionality
- Reads system routing table
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information