f327ab37d2c795344b9ece6b06744d3ec0b2fb0bffa4f3001c36080c1f1f2189

Analysis

max time kernel
135s
max time network
139s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20250307-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20250307-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
08/03/2025, 15:25

Target

f327ab37d2c795344b9ece6b06744d3ec0b2fb0bffa4f3001c36080c1f1f2189.elf
Size

116KB
MD5

3fe14dd4eda98e3a70901413189cd598
SHA1

c6efa5350577fc9b7b10a1eef0a538a7b03bdb38
SHA256

f327ab37d2c795344b9ece6b06744d3ec0b2fb0bffa4f3001c36080c1f1f2189
SHA512

fea08d29dbf446888c080338a3ddeff2cbe32b7e5bf99ae7d0c05026c14d3162335bd679db7e2d9a2704ed33b66ab86cb122e64ae78c1936ec1a4fbdde08fcd2
SSDEEP

1536:uakh1I+6HIVbCxBCrJyrC3YyGd18SQZWR6AcwD02UzDxHB5UAe9QZ/:uakQ+6oV2C9y2YyGHpwrwD7UzXOe

Score

9^/10

discovery rootkit

Contacts a large (3073) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Loads a kernel module 5 IoCs

Loads a Linux kernel module, potentially to achieve persistence

pid	Process
7455	f327ab37d2c795344b9ece6b06744d3ec0b2fb0bffa4f3001c36080c1f1f2189.elf
7455	f327ab37d2c795344b9ece6b06744d3ec0b2fb0bffa4f3001c36080c1f1f2189.elf
7455	f327ab37d2c795344b9ece6b06744d3ec0b2fb0bffa4f3001c36080c1f1f2189.elf
7456	f327ab37d2c795344b9ece6b06744d3ec0b2fb0bffa4f3001c36080c1f1f2189.elf
7456	f327ab37d2c795344b9ece6b06744d3ec0b2fb0bffa4f3001c36080c1f1f2189.elf

/tmp/f327ab37d2c795344b9ece6b06744d3ec0b2fb0bffa4f3001c36080c1f1f2189.elf
/tmp/f327ab37d2c795344b9ece6b06744d3ec0b2fb0bffa4f3001c36080c1f1f2189.elf
1⤵
- Loads a kernel module
PID:7455

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact