Overview

overview

10

Static

static

10

客户端(...EY.exe

windows7-x64

9

客户端(...EY.exe

windows10-2004-x64

9

UDP.exe

windows7-x64

3

UDP.exe

windows10-2004-x64

3

a

ubuntu-24.04-amd64

8

arm1

debian-9-armhf

4

bj.exe

windows7-x64

10

bj.exe

windows10-2004-x64

10

bjyk.exe

windows7-x64

10

bjyk.exe

windows10-2004-x64

10

cctv.exe

windows7-x64

7

cctv.exe

windows10-2004-x64

10

cctv_2.exe

windows7-x64

1

cctv_2.exe

windows10-2004-x64

10

cn.exe

windows7-x64

7

cn.exe

windows10-2004-x64

7

cn1.exe

windows7-x64

7

cn1.exe

windows10-2004-x64

3

dhl.exe

windows7-x64

10

dhl.exe

windows10-2004-x64

10

java

ubuntu-18.04-amd64

4

java (2)

ubuntu-24.04-amd64

1

java1

ubuntu-24.04-amd64

7

k5.exe

windows7-x64

8

k5.exe

windows10-2004-x64

10

ly1

debian-9-mips

3

mh.exe

windows7-x64

10

mh.exe

windows10-2004-x64

10

mips

debian-12-mipsel

4

pjhxx

ubuntu-24.04-amd64

1

rootkit

ubuntu-24.04-amd64

8

se.exe

windows7-x64

7

Resubmissions

02-01-2025 21:33

250102-1ejbvswpcv 10

08-12-2024 01:12

241208-bkq68azkep 10

Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    02-01-2025 21:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    java1

  • Size

    1.5MB

  • MD5

    b94d195896ac0aa647a2334f74e1aa73

  • SHA1

    58792006cd89f0689a2eb4766af298305954c653

  • SHA256

    fc10540c1effe99bdd7a9e1025bdda6813f5dbbdb6e89acdbf79df443a5bba49

  • SHA512

    1d4f0427d6ffc456afa34e5edb1742a238866106a3cdbfa7866692aadd4810114f53111671d2fecbe396cf42f590f6beee29afee74893eb33bb0854ef78a3ef1

  • SSDEEP

    24576:hNJp/2SkgT4KUAopmhDO2Aan9XgnU6tZAf4Nzbm6g+qF2SdYOrhGz+bL+cH8y6LL:hNvOx/Vp/2bn9XgnNtmf28rh0bccIwhL

Score
7/10
rootkit

Malware Config

Signatures

  • Loads a kernel module 1 IoCs

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit

Processes

  • /tmp/java1
    /tmp/java1
    1⤵
    • Loads a kernel module
    PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads