19b3668761376a902bed2ff27aac7107f14e9f76eae85f06719c25c7777c85e9 | Triage

Analysis

max time kernel
136s
max time network
148s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22/01/2025, 16:11

Sharing

Report Analysis Logs

General

Target

krfk64.elf
Size

156KB
MD5

eebf4b2b2defd1f78281d591461eefdc
SHA1

9bbadec29e767d24c22230ec64bc64369c21ca25
SHA256

19b3668761376a902bed2ff27aac7107f14e9f76eae85f06719c25c7777c85e9
SHA512

7b92b6cb0a39694a8e5221bbe7e521494e2aaa2e116a7c7868a37b332ea29c92fcbdb256b984fa85b30609d48fae4058f4a140b84c9ed4e2454d3aebe1ff0d74
SSDEEP

3072:nMm4EPBMqOlPhX6qE2efpchx0XXzbD9jC4CU/ek21iZkn9rkKUb:nMm4EP6qOlPhZeywIVi7E9r9M

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1491	krfk64.elf

Traces itself 1 IoCs

Traces itself to prevent debugging attempts

pid	Process
1491	krfk64.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	httpd	1490	krfk64.elf

Writes file to tmp directory 9 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Z[HI_J]VZQY>	krfk64.elf
File opened for modification	/tmp/\WPI_J]VZQY>	krfk64.elf
File opened for modification	/tmp/Z[HxjizjI_J]VZQY>	krfk64.elf
File opened for modification	/tmp/[J]Z[X_KRJI_J]VZQY>	krfk64.elf
File opened for modification	/tmp/Z[HSWM]I_J]VZQY>	krfk64.elf
File opened for modification	/tmp/M\WPI_J]VZQY>	krfk64.elf
File opened for modification	/tmp/Z[HxjizjaI_J]VZQY>	krfk64.elf
File opened for modification	/tmp/Z[HI_J]VZQY>	krfk64.elf
File opened for modification	/tmp/[J]I_J]VZQY>	krfk64.elf

/tmp/krfk64.elf
/tmp/krfk64.elf
1⤵
- Deletes itself
- Traces itself
- Changes its process name
- Writes file to tmp directory
PID:1490

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads