Overview

overview

10

Static

static

10

hoodlum.x86.elf

ubuntu-20.04-amd64

7

Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240611-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    22/02/2025, 17:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    hoodlum.x86.elf

  • Size

    124KB

  • MD5

    2753bd027c47e340f8c86dd68384e07a

  • SHA1

    1da23843004df8c95c61775c9134a7202a1569aa

  • SHA256

    b18fd19ba74bb9322a684d9fceda45d57c587f6d2488b8b45a093531762d0020

  • SHA512

    def2bf3bc23898118096313f80921ff1aa7ae971d3c8bd32476e865f0e4fb10230822f91a1dd524870fd8270f7df22adba372ec3aeaa8816d47a859fbcf7a5da

  • SSDEEP

    3072:Oxue61TMvUrvllA0F+6NcAphaDD65k+Lm5t4WthVz:A+vltZphaDgm5t4OhVz

Score
7/10
defense_evasiondiscoveryprivilege_escalationstealer

Malware Config

Signatures

  • Deletes Audit logs 1 TTPs 1 IoCs

    Deletes logs related to the Linux Audit framework.

    defense_evasion
  • Deletes itself 1 IoCs
  • Deletes journal logs 1 TTPs 4 IoCs

    Deletes systemd journal logs. Likely to evade detection.

    defense_evasion
  • Deletes system logs 1 TTPs 2 IoCs

    Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    defense_evasion
  • Flushes firewall rules 1 TTPs 7 IoCs

    Flushes/ disables firewall rules inside the Linux kernel.

    defense_evasion
  • Reads EFI boot settings 1 TTPs 6 IoCs

    Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

    stealer
  • Writes DNS configuration 1 TTPs 1 IoCs

    Writes data to DNS resolver config file.

  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

    Abuse sudo or cached sudo credentials to execute code.

    privilege_escalationdefense_evasion
  • Deletes log files 1 TTPs 43 IoCs

    Deletes log files on the system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  • Changes its process name 1 IoCs
  • Reads CPU attributes 1 TTPs 3 IoCs
    discovery
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/hoodlum.x86.elf
    /tmp/hoodlum.x86.elf
    1⤵
    • Deletes itself
    • Writes DNS configuration
    • Reads system routing table
    • Changes its process name
    • Reads system network configuration
    PID:1388
    • /bin/sh
      sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"
      2⤵
        PID:1391
        • /usr/bin/rm
          rm -rf /tmp/config-err-amP4Fn /tmp/snap-private-tmp /tmp/ssh-gnjJqNtBTGvS /tmp/systemd-private-4ce339a1afb04db4a0dcdfa7220c8aab-ModemManager.service-oXLOAi /tmp/systemd-private-4ce339a1afb04db4a0dcdfa7220c8aab-colord.service-VXq4hi /tmp/systemd-private-4ce339a1afb04db4a0dcdfa7220c8aab-switcheroo-control.service-1mWQbf /tmp/systemd-private-4ce339a1afb04db4a0dcdfa7220c8aab-systemd-logind.service-J4qakh /tmp/systemd-private-4ce339a1afb04db4a0dcdfa7220c8aab-systemd-resolved.service-Lib3lj /tmp/systemd-private-4ce339a1afb04db4a0dcdfa7220c8aab-systemd-timedated.service-QprjJf /tmp/systemd-private-4ce339a1afb04db4a0dcdfa7220c8aab-upower.service-KFH4mi /var/backups /var/cache /var/crash /var/lib /var/local /var/lock /var/log /var/mail /var/metrics /var/opt /var/run /var/snap /var/spool /var/tmp /var/run/NetworkManager /var/run/acpid.pid /var/run/acpid.socket /var/run/agetty.reload /var/run/atd.pid /var/run/auditd.pid /var/run/avahi-daemon /var/run/blkid /var/run/console-setup /var/run/crond.pid /var/run/crond.reboot /var/run/cups /var/run/dbus /var/run/fsck /var/run/gdm3 /var/run/gdm3.pid /var/run/initctl /var/run/initramfs /var/run/lock /var/run/log /var/run/mount /var/run/openvpn /var/run/openvpn-client /var/run/openvpn-server /var/run/sendsigs.omit.d /var/run/shm /var/run/snapd-snap.socket /var/run/snapd.socket /var/run/speech-dispatcher /var/run/spice-vdagentd /var/run/sshd /var/run/sshd.pid /var/run/sudo /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/udisks2 /var/run/user /var/run/utmp /var/run/uuidd /var/tmp/systemd-private-4ce339a1afb04db4a0dcdfa7220c8aab-ModemManager.service-aiTDRf /var/tmp/systemd-private-4ce339a1afb04db4a0dcdfa7220c8aab-colord.service-bSm4wg /var/tmp/systemd-private-4ce339a1afb04db4a0dcdfa7220c8aab-switcheroo-control.service-LP6nlg /var/tmp/systemd-private-4ce339a1afb04db4a0dcdfa7220c8aab-systemd-logind.service-Abc2xf /var/tmp/systemd-private-4ce339a1afb04db4a0dcdfa7220c8aab-systemd-resolved.service-1Xijcf /var/tmp/systemd-private-4ce339a1afb04db4a0dcdfa7220c8aab-systemd-timedated.service-8e9Uih /var/tmp/systemd-private-4ce339a1afb04db4a0dcdfa7220c8aab-upower.service-nBA3hh
          3⤵
          • Deletes Audit logs
          • Deletes journal logs
          • Deletes system logs
          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
          • Deletes log files
          PID:1392
      • /bin/sh
        sh -c "rm -rf /var/log/wtmp"
        2⤵
          PID:1436
          • /usr/bin/rm
            rm -rf /var/log/wtmp
            3⤵
            • Deletes log files
            PID:1437
        • /bin/sh
          sh -c "rm -rf /tmp/*"
          2⤵
            PID:1438
            • /usr/bin/rm
              rm -rf "/tmp/*"
              3⤵
                PID:1439
            • /bin/sh
              sh -c "rm -rf /bin/netstat"
              2⤵
                PID:1440
                • /usr/bin/rm
                  rm -rf /bin/netstat
                  3⤵
                    PID:1441
                • /bin/sh
                  sh -c "iptables -F"
                  2⤵
                  • System Network Configuration Discovery
                  PID:1442
                  • /usr/sbin/iptables
                    iptables -F
                    3⤵
                    • Flushes firewall rules
                    PID:1443
                • /bin/sh
                  sh -c "pkill -9 busybox"
                  2⤵
                    PID:1447
                    • /usr/bin/pkill
                      pkill -9 busybox
                      3⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:1448
                  • /bin/sh
                    sh -c "pkill -9 perl"
                    2⤵
                      PID:1449
                      • /usr/bin/pkill
                        pkill -9 perl
                        3⤵
                        • Reads CPU attributes
                        • Reads runtime system information
                        PID:1450
                    • /bin/sh
                      sh -c "pkill -9 python"
                      2⤵
                        PID:1451
                        • /usr/bin/pkill
                          pkill -9 python
                          3⤵
                          • Reads CPU attributes
                          • Reads runtime system information
                          PID:1452
                      • /bin/sh
                        sh -c "service iptables stop"
                        2⤵
                        • System Network Configuration Discovery
                        PID:1453
                        • /usr/sbin/service
                          service iptables stop
                          3⤵
                          • System Network Configuration Discovery
                          PID:1454
                          • /usr/bin/basename
                            basename /usr/sbin/service
                            4⤵
                              PID:1455
                            • /usr/bin/basename
                              basename /usr/sbin/service
                              4⤵
                                PID:1456
                              • /usr/bin/systemctl
                                systemctl --quiet is-active multi-user.target
                                4⤵
                                • Reads EFI boot settings
                                • Reads runtime system information
                                PID:1457
                              • /usr/bin/sed
                                sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                4⤵
                                  PID:1460
                                • /usr/bin/systemctl
                                  systemctl list-unit-files --full "--type=socket"
                                  4⤵
                                  • Reads EFI boot settings
                                  PID:1459
                              • /usr/local/sbin/systemctl
                                systemctl stop iptables.service
                                3⤵
                                  PID:1454
                                • /usr/local/bin/systemctl
                                  systemctl stop iptables.service
                                  3⤵
                                    PID:1454
                                  • /usr/sbin/systemctl
                                    systemctl stop iptables.service
                                    3⤵
                                      PID:1454
                                    • /usr/bin/systemctl
                                      systemctl stop iptables.service
                                      3⤵
                                      • Reads EFI boot settings
                                      PID:1454
                                  • /bin/sh
                                    sh -c "/sbin/iptables -F; /sbin/iptables -X"
                                    2⤵
                                    • System Network Configuration Discovery
                                    PID:1461
                                    • /sbin/iptables
                                      /sbin/iptables -F
                                      3⤵
                                      • Flushes firewall rules
                                      PID:1462
                                    • /sbin/iptables
                                      /sbin/iptables -X
                                      3⤵
                                      • Flushes firewall rules
                                      PID:1463
                                  • /bin/sh
                                    sh -c "service firewalld stop"
                                    2⤵
                                      PID:1464
                                      • /usr/sbin/service
                                        service firewalld stop
                                        3⤵
                                          PID:1465
                                          • /usr/bin/basename
                                            basename /usr/sbin/service
                                            4⤵
                                              PID:1466
                                            • /usr/bin/basename
                                              basename /usr/sbin/service
                                              4⤵
                                                PID:1467
                                              • /usr/bin/systemctl
                                                systemctl --quiet is-active multi-user.target
                                                4⤵
                                                • Reads EFI boot settings
                                                • Reads runtime system information
                                                PID:1468
                                              • /usr/bin/sed
                                                sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                                4⤵
                                                  PID:1471
                                                • /usr/bin/systemctl
                                                  systemctl list-unit-files --full "--type=socket"
                                                  4⤵
                                                  • Reads EFI boot settings
                                                  PID:1470
                                              • /usr/local/sbin/systemctl
                                                systemctl stop firewalld.service
                                                3⤵
                                                • Flushes firewall rules
                                                PID:1465
                                              • /usr/local/bin/systemctl
                                                systemctl stop firewalld.service
                                                3⤵
                                                • Flushes firewall rules
                                                PID:1465
                                              • /usr/sbin/systemctl
                                                systemctl stop firewalld.service
                                                3⤵
                                                • Flushes firewall rules
                                                PID:1465
                                              • /usr/bin/systemctl
                                                systemctl stop firewalld.service
                                                3⤵
                                                • Flushes firewall rules
                                                • Reads EFI boot settings
                                                PID:1465
                                            • /bin/sh
                                              sh -c "rm -rf ~/.bash_history"
                                              2⤵
                                                PID:1472
                                                • /usr/bin/rm
                                                  rm -rf "~/.bash_history"
                                                  3⤵
                                                    PID:1473
                                                • /bin/sh
                                                  sh -c "history -c"
                                                  2⤵
                                                    PID:1474

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads