Overview

overview

10

Static

static

10

x86.elf

ubuntu-24.04-amd64

9

Analysis

  • max time kernel
    118s
  • max time network
    154s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240729-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240729-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    10-02-2025 21:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    x86.elf

  • Size

    48KB

  • MD5

    09081f6bb925c11977d58e0c7c7c4565

  • SHA1

    f8b5f731d22918991b6948819a6f1909b8cce228

  • SHA256

    aed80574b7f404e80f3ddea523a856799d1382a5c53ed494ced6d31062f80375

  • SHA512

    b99667bce9ddfc887cc0f9e6216b22839a00fb7ea77611e6eb10aecc523c35461e7755bc1c8e3f9b58ec1611962e589dcccafa505de1d343f4d850283855bad8

  • SSDEEP

    1536:aH3oG7jBo2VZXuP58uwVcROH9u/Sre1szExab:aH40jBo2ru58uUcoc/SreyzS8

Score
9/10
discoveryrootkit

Malware Config

Signatures

  • Contacts a large (183661) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Loads a kernel module 3 IoCs

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes

  • /tmp/x86.elf
    /tmp/x86.elf
    1⤵
    • Loads a kernel module
    PID:2454

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads