Analysis
-
max time kernel
99s -
max time network
109s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
19-02-2025 18:39
Behavioral task
behavioral1
Sample
x86
Resource
ubuntu2204-amd64-20240729-en
ubuntu-22.04-amd64
General
-
Target
x86
-
Size
68KB
-
MD5
6a56182d5fe6403cd09c7bbe63d2c08c
-
SHA1
f0aae8322a17a937e62215e6b3ce0ef5b3b44b5b
-
SHA256
5a067b7d42af00dd2292692f9df595368418c1ea94609ed747918b85d9c49d69
-
SHA512
80dc8e23d7560a8a04ef7ae9c896055a4bacdd43c5eb1028eaeed381f6c287eab7a4d57dff2c219b2f05f4c92a73411b085ec1a9dc3fce038cb01a9fa675ce6c
-
SSDEEP
1536:HafAEdoRs3D25y5uScmhYr/pNeITYNDIIFeg5ORCFYVX0ijP:HeWs3D25y5Tcmhq/p4ITYN9d9FU/
Malware Config
Signatures
-
Contacts a large (183770) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description pid Changes the process name, possibly in an attempt to hide itself 1580 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp -
description ioc File opened for reading /proc/608/fd File opened for reading /proc/855/exe File opened for reading /proc/965/exe File opened for reading /proc/1704/exe File opened for reading /proc/416/fd File opened for reading /proc/619/fd File opened for reading /proc/1678/exe File opened for reading /proc/667/exe File opened for reading /proc/874/exe File opened for reading /proc/1647/exe File opened for reading /proc/1657/exe File opened for reading /proc/1917/exe File opened for reading /proc/726/fd File opened for reading /proc/1039/exe File opened for reading /proc/1670/exe File opened for reading /proc/642/fd File opened for reading /proc/593/exe File opened for reading /proc/642/exe File opened for reading /proc/1624/exe File opened for reading /proc/412/exe File opened for reading /proc/416/exe File opened for reading /proc/506/exe File opened for reading /proc/992/exe File opened for reading /proc/1019/exe File opened for reading /proc/1673/exe File opened for reading /proc/427/exe File opened for reading /proc/671/exe File opened for reading /proc/693/fd File opened for reading /proc/593/fd File opened for reading /proc/740/exe File opened for reading /proc/870/exe File opened for reading /proc/1581/exe File opened for reading /proc/778/exe File opened for reading /proc/974/exe File opened for reading /proc/1590/exe File opened for reading /proc/1650/exe File opened for reading /proc/643/fd File opened for reading /proc/532/exe File opened for reading /proc/587/exe File opened for reading /proc/592/exe File opened for reading /proc/611/exe File opened for reading /proc/637/exe File opened for reading /proc/1690/exe File opened for reading /proc/643/exe File opened for reading /proc/982/exe File opened for reading /proc/1595/exe File opened for reading /proc/528/exe File opened for reading /proc/831/exe File opened for reading /proc/834/exe File opened for reading /proc/1388/exe File opened for reading /proc/997/exe File opened for reading /proc/1594/exe File opened for reading /proc/740/fd File opened for reading /proc/585/exe File opened for reading /proc/619/exe File opened for reading /proc/1587/exe File opened for reading /proc/528/fd File opened for reading /proc/636/fd File opened for reading /proc/1718/exe File opened for reading /proc/587/fd File opened for reading /proc/726/exe File opened for reading /proc/959/exe File opened for reading /proc/1654/exe File opened for reading /proc/1895/exe