Overview

overview

10

Static

static

10

i586.elf

ubuntu-22.04-amd64

7

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240522.1-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    06-01-2025 23:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    i586.elf

  • Size

    69KB

  • MD5

    2d0bd765ed70648d44343839f6927c45

  • SHA1

    9348135e9d1e451b6b0b45b1017c5c6e29900a43

  • SHA256

    cbf5056d52a2ae8703611527edd723b72dcfa0ea3c7576c09f728f379d124220

  • SHA512

    f82ebd3fbda4d6ed0ae6baa9c317fcb0f5f8b7738c139972a7a8d4760349e610db5977c0172d9fd595beac0a9e26e088b259c4a395ca8985b13ce5cf451c0890

  • SSDEEP

    1536:yPQsRePYB4WZhMXaH96kYVBKBoj1d21vlOmNtW:yPtMPYB4WZhMXoYmBoZdedPA

Score
7/10
defense_evasiondiscoveryevasionpersistenceprivilege_escalation

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Deletes journal logs 1 TTPs 1 IoCs

    Deletes systemd journal logs. Likely to evade detection.

    evasion
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/i586.elf
    /tmp/i586.elf
    1⤵
    • Deletes itself
    • Deletes journal logs
    • Modifies Watchdog functionality
    • Modifies systemd
    • Changes its process name
    • Reads runtime system information
    PID:1551
    • /bin/sh
      sh -c "systemctl daemon-reload"
      2⤵
        PID:1555
        • /usr/bin/systemctl
          systemctl daemon-reload
          3⤵
            PID:1557
        • /bin/sh
          sh -c "systemctl enable startup_command.service"
          2⤵
            PID:1609
            • /usr/bin/systemctl
              systemctl enable startup_command.service
              3⤵
              • Reads runtime system information
              PID:1610

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /etc/systemd/system/startup_command.service
          Filesize

          361B

          MD5

          af7d62b73266e0b457b114fe91f7e926

          SHA1

          11261aef4573b56b67b32020049c69c7282fc212

          SHA256

          14cb525e5a6b8aaf20c38672f8a9f974a684990888214848818326a739906642

          SHA512

          3926fbb53496c3aaa34cc782bd5c8379e0ab94b11fe4e63bbbfeac4e2b5057369c94bbe25ac56c3f04363076c91b978f9199fed97c5ed8377a6dc852b01ebfd9

          Download Submit