Analysis
-
max time kernel
29s -
max time network
34s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20241127-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20241127-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
31-01-2025 18:24
Behavioral task
behavioral1
Sample
x86 (2)
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
5 signatures
30 seconds
Behavioral task
behavioral2
Sample
x86 (2)
Resource
ubuntu2004-amd64-20241127-en
ubuntu-20.04-amd64
5 signatures
30 seconds
Behavioral task
behavioral3
Sample
x86 (2)
Resource
ubuntu2204-amd64-20240729-en
ubuntu-22.04-amd64
5 signatures
30 seconds
General
-
Target
x86 (2)
-
Size
54KB
-
MD5
b180c519dee8619995c2a2acedc7d2b4
-
SHA1
95b340b868007f0bf338aa2ac34b33c9caa7d9a8
-
SHA256
deb05b353c51481cba1eb6acfac01d4e4a1e0bf687f8ad6bb54c51b2e0b04e2c
-
SHA512
633737009b3a028f4ef073ce7393671d4ff7c5f26b2e87ad48ce10dafd502cd91520f82f803331b949c1eeecdcb0daaf09e6e618382fe5a470c6d9f99de2b728
-
SSDEEP
1536:JeESt/basV2rcZhG6yZN7nanlSR9zWOIaEjrqMGs:JeESt/basVTg57nanQRVtXESp
Score
9/10
Malware Config
Signatures
-
Contacts a large (7170) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself /bin/watchdog 1397 -
description ioc File opened for reading /proc/1153/cmdline File opened for reading /proc/1346/cmdline File opened for reading /proc/1386/cmdline File opened for reading /proc/3/cmdline File opened for reading /proc/449/cmdline File opened for reading /proc/1097/cmdline File opened for reading /proc/84/cmdline File opened for reading /proc/402/cmdline File opened for reading /proc/505/cmdline File opened for reading /proc/611/cmdline File opened for reading /proc/933/cmdline File opened for reading /proc/6/cmdline File opened for reading /proc/10/cmdline File opened for reading /proc/75/cmdline File opened for reading /proc/957/cmdline File opened for reading /proc/1387/cmdline File opened for reading /proc/458/cmdline File opened for reading /proc/493/cmdline File opened for reading /proc/754/cmdline File opened for reading /proc/1106/cmdline File opened for reading /proc/1327/cmdline File opened for reading /proc/19/cmdline File opened for reading /proc/87/cmdline File opened for reading /proc/168/cmdline File opened for reading /proc/987/cmdline File opened for reading /proc/1227/cmdline File opened for reading /proc/82/cmdline File opened for reading /proc/566/cmdline File opened for reading /proc/591/cmdline File opened for reading /proc/24/cmdline File opened for reading /proc/79/cmdline File opened for reading /proc/996/cmdline File opened for reading /proc/806/cmdline File opened for reading /proc/925/cmdline File opened for reading /proc/1082/cmdline File opened for reading /proc/1098/cmdline File opened for reading /proc/1333/cmdline File opened for reading /proc/21/cmdline File opened for reading /proc/242/cmdline File opened for reading /proc/459/cmdline File opened for reading /proc/176/cmdline File opened for reading /proc/400/cmdline File opened for reading /proc/88/cmdline File opened for reading /proc/89/cmdline File opened for reading /proc/170/cmdline File opened for reading /proc/1329/cmdline File opened for reading /proc/23/cmdline File opened for reading /proc/1089/cmdline File opened for reading /proc/1210/cmdline File opened for reading /proc/620/cmdline File opened for reading /proc/1009/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/15/cmdline File opened for reading /proc/92/cmdline File opened for reading /proc/1401/cmdline File opened for reading /proc/162/cmdline File opened for reading /proc/164/cmdline File opened for reading /proc/1334/cmdline File opened for reading /proc/776/cmdline File opened for reading /proc/11/cmdline File opened for reading /proc/172/cmdline File opened for reading /proc/498/cmdline File opened for reading /proc/814/cmdline File opened for reading /proc/924/cmdline