Overview

overview

10

Static

static

10

客户端(...EY.exe

windows7-x64

9

客户端(...EY.exe

windows10-2004-x64

9

UDP.exe

windows7-x64

3

UDP.exe

windows10-2004-x64

3

a

ubuntu-24.04-amd64

8

arm1

debian-9-armhf

4

bj.exe

windows7-x64

10

bj.exe

windows10-2004-x64

10

bjyk.exe

windows7-x64

10

bjyk.exe

windows10-2004-x64

10

cctv.exe

windows7-x64

7

cctv.exe

windows10-2004-x64

10

cctv_2.exe

windows7-x64

1

cctv_2.exe

windows10-2004-x64

10

cn.exe

windows7-x64

7

cn.exe

windows10-2004-x64

7

cn1.exe

windows7-x64

7

cn1.exe

windows10-2004-x64

3

dhl.exe

windows7-x64

10

dhl.exe

windows10-2004-x64

10

java

ubuntu-18.04-amd64

4

java (2)

ubuntu-24.04-amd64

1

java1

ubuntu-24.04-amd64

7

k5.exe

windows7-x64

8

k5.exe

windows10-2004-x64

10

ly1

debian-9-mips

3

mh.exe

windows7-x64

10

mh.exe

windows10-2004-x64

10

mips

debian-12-mipsel

4

pjhxx

ubuntu-24.04-amd64

1

rootkit

ubuntu-24.04-amd64

8

se.exe

windows7-x64

7

Resubmissions

02-01-2025 21:33

250102-1ejbvswpcv 10

08-12-2024 01:12

241208-bkq68azkep 10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    02-01-2025 21:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a

  • Size

    1.3MB

  • MD5

    84839072ae06ae3e47d93f3b79067305

  • SHA1

    eb578777ca88dcaa72cb9b22720618b2e3aa770f

  • SHA256

    dd77459b8d76d9be75dde3f2aa8e8434b266bc98acd15966c6ae65a6620b10db

  • SHA512

    3b004be47b8aef3ce9ee821d267ef4e36dfb2a17bdbbf8630f24f119f3ad26c862a79a1e8afafe7e98422479eb58dd8b2ee5c644d3aef84f9bb2eab991f878de

  • SSDEEP

    24576:X8BHnVsZc1VZneCEuvLmJ7p9fomAmgAspprQYlGtmgmH1LJSwYS3uJdE0cG/v5FH:YHnVec1VZnezuvLmJrfvAmgAspprVlGR

Score
8/10
rootkit

Malware Config

Signatures

  • Writes memory of remote process 3 IoCs
  • Loads a kernel module 64 IoCs

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit

Processes

  • /tmp/a
    /tmp/a
    1⤵
    • Writes memory of remote process
    • Loads a kernel module
    PID:2418

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads