Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20250307-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20250307-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
08/03/2025, 03:10
Behavioral task
behavioral1
Sample
0c9ab85d15b5533addbfd926d6c526168d95a0980596389d998a01468d1e1ba9.elf
Resource
ubuntu2204-amd64-20250307-en
ubuntu-22.04-amd64
General
-
Target
0c9ab85d15b5533addbfd926d6c526168d95a0980596389d998a01468d1e1ba9.elf
-
Size
34KB
-
MD5
907426a4ce128f32b2ecb7172d851757
-
SHA1
bbe2c04c981d22fa5ea0551f6c6c2a241e3ea78a
-
SHA256
0c9ab85d15b5533addbfd926d6c526168d95a0980596389d998a01468d1e1ba9
-
SHA512
feb4cc473af3d18432d93f9bffae6df44b8e77bc1333977f886e5c312e2cc76d4da2245499ea46ecda8074727732792d9bed832890f5ba2aa39c6fad2455af30
-
SSDEEP
768:Uj+6gKDn2fk+HCvKaT7WXESN/KuJ7fkIpll:Uj3r2pankViupsIpll
Malware Config
Signatures
-
Contacts a large (14800) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/misc/watchdog File opened for modification /dev/watchdog -
Renames itself 1 IoCs
pid 1562 -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.53.15.127 -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself power-profiles- 1562 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp -
description ioc File opened for reading /proc/15/comm File opened for reading /proc/78/comm File opened for reading /proc/782/comm File opened for reading /proc/914/comm File opened for reading /proc/446/status File opened for reading /proc/1552/status File opened for reading /proc/630/comm File opened for reading /proc/1372/comm File opened for reading /proc/606/status File opened for reading /proc/777/status File opened for reading /proc/86/comm File opened for reading /proc/221/comm File opened for reading /proc/222/comm File opened for reading /proc/633/comm File opened for reading /proc/677/comm File opened for reading /proc/1088/comm File opened for reading /proc/736/status File opened for reading /proc/891/status File opened for reading /proc/732/comm File opened for reading /proc/1028/comm File opened for reading /proc/1075/comm File opened for reading /proc/1089/comm File opened for reading /proc/1239/comm File opened for reading /proc/704/status File opened for reading /proc/1095/status File opened for reading /proc/1166/status File opened for reading /proc/1166/comm File opened for reading /proc/1192/comm File opened for reading /proc/1354/comm File opened for reading /proc/1485/comm File opened for reading /proc/1172/status File opened for reading /proc/self/maps File opened for reading /proc/93/comm File opened for reading /proc/113/comm File opened for reading /proc/606/comm File opened for reading /proc/1367/status File opened for reading /proc/74/comm File opened for reading /proc/1158/comm File opened for reading /proc/1173/status File opened for reading /proc/925/comm File opened for reading /proc/1169/comm File opened for reading /proc/21/comm File opened for reading /proc/758/comm File opened for reading /proc/1225/comm File opened for reading /proc/73/comm File opened for reading /proc/90/comm File opened for reading /proc/211/comm File opened for reading /proc/649/comm File opened for reading /proc/1062/status File opened for reading /proc/12/comm File opened for reading /proc/77/comm File opened for reading /proc/220/comm File opened for reading /proc/1039/comm File opened for reading /proc/1156/comm File opened for reading /proc/1181/comm File opened for reading /proc/763/status File opened for reading /proc/784/status File opened for reading /proc/76/comm File opened for reading /proc/1151/status File opened for reading /proc/1430/status File opened for reading /proc/25/comm File opened for reading /proc/162/comm File opened for reading /proc/1103/comm File opened for reading /proc/1443/comm