Overview

overview

10

Static

static

10

54ab484a82...5f.elf

ubuntu-20.04-amd64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    54ab484a8249dcc8c36cd28c22546b518836e12d7bae3fbed3b3642453f73d5f.elf

  • Size

    72KB

  • Sample

    250202-ext1esvngt

  • MD5

    9a0249531baca3cf92ebe1fa27522d92

  • SHA1

    89eba585573b74ee422bece2ae70fc540345cad7

  • SHA256

    54ab484a8249dcc8c36cd28c22546b518836e12d7bae3fbed3b3642453f73d5f

  • SHA512

    4df28512f00112adfa9ae1839cb9977f8e315022c08378c0d0a091c78a7f2f29911e669558ef3637ceaaed74c7ebb9bf3c9a454a2805a3b0899a22b9cf5d3cef

  • SSDEEP

    1536:cBuGUrgqzxzeRuTFtrPNJczvMSpuxf2UOKvMzg6wnAVJwA:aujzFouTDrNJczSFdOKEzggVJwA

Score
10/10
miraicredential_accessdefense_evasiondiscoverylinux

Malware Config

Targets

    • Target

      54ab484a8249dcc8c36cd28c22546b518836e12d7bae3fbed3b3642453f73d5f.elf

    • Size

      72KB

    • MD5

      9a0249531baca3cf92ebe1fa27522d92

    • SHA1

      89eba585573b74ee422bece2ae70fc540345cad7

    • SHA256

      54ab484a8249dcc8c36cd28c22546b518836e12d7bae3fbed3b3642453f73d5f

    • SHA512

      4df28512f00112adfa9ae1839cb9977f8e315022c08378c0d0a091c78a7f2f29911e669558ef3637ceaaed74c7ebb9bf3c9a454a2805a3b0899a22b9cf5d3cef

    • SSDEEP

      1536:cBuGUrgqzxzeRuTFtrPNJczvMSpuxf2UOKvMzg6wnAVJwA:aujzFouTDrNJczSFdOKEzggVJwA

    Score
    9/10
    credential_accessdefense_evasiondiscovery

    • Contacts a large (23832) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

    • Reads process memory

      Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

      credential_access
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks