Analysis
-
max time kernel
29s -
max time network
149s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20250307-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20250307-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
09/03/2025, 15:22
Behavioral task
behavioral1
Sample
a.elf
Resource
ubuntu2204-amd64-20250307-en
ubuntu-22.04-amd64
9 signatures
150 seconds
General
-
Target
a.elf
-
Size
68KB
-
MD5
e7f92c4e413c935c0a18829ec85f0628
-
SHA1
5f9ca32a4e93a51ed8127dceb54e2e003d9cc015
-
SHA256
656258b719c63b4436a318edf0602f200cb3207ec2c664fa4647352430baeda2
-
SHA512
9f00d5e0dd1929d55d162d8d6e582ffce9fd75d8e17eae19f138f40ef0102cac87532dfd948cb10921b7f74650d6c11d04e7d3e4ceb272d867c615038eb5a32d
-
SSDEEP
1536:eBYl8ZgUNE2QstBXXJff5KWq8M2hMze5qxOq5GzfnjOaAKbiA0:AMKgUNE2QsbXJ35I8M2hMze5qxOq5GzZ
Score
9/10
Malware Config
Signatures
-
Contacts a large (218235) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc File opened for reading /proc/592/maps File opened for reading /proc/612/maps File opened for reading /proc/789/maps File opened for reading /proc/798/maps File opened for reading /proc/88/maps File opened for reading /proc/6/maps File opened for reading /proc/13/maps File opened for reading /proc/119/maps File opened for reading /proc/263/maps File opened for reading /proc/18/maps File opened for reading /proc/160/maps File opened for reading /proc/638/maps File opened for reading /proc/731/maps File opened for reading /proc/787/maps File opened for reading /proc/893/maps File opened for reading /proc/972/maps File opened for reading /proc/97/maps File opened for reading /proc/415/maps File opened for reading /proc/967/maps File opened for reading /proc/5/maps File opened for reading /proc/7/maps File opened for reading /proc/218/maps File opened for reading /proc/585/maps File opened for reading /proc/2/maps File opened for reading /proc/19/maps File opened for reading /proc/91/maps File opened for reading /proc/208/maps File opened for reading /proc/667/maps File opened for reading /proc/10/maps File opened for reading /proc/20/maps File opened for reading /proc/73/maps File opened for reading /proc/94/maps File opened for reading /proc/988/maps File opened for reading /proc/9/maps File opened for reading /proc/75/maps File opened for reading /proc/82/maps File opened for reading /proc/83/maps File opened for reading /proc/98/maps File opened for reading /proc/685/maps File opened for reading /proc/27/maps File opened for reading /proc/198/maps File opened for reading /proc/774/maps File opened for reading /proc/22/maps File opened for reading /proc/996/maps File opened for reading /proc/11/maps File opened for reading /proc/26/maps File opened for reading /proc/89/maps File opened for reading /proc/314/maps File opened for reading /proc/408/maps File opened for reading /proc/502/maps File opened for reading /proc/613/maps File opened for reading /proc/947/maps File opened for reading /proc/102/maps File opened for reading /proc/925/maps File opened for reading /proc/101/maps File opened for reading /proc/202/maps File opened for reading /proc/377/maps File opened for reading /proc/426/maps File opened for reading /proc/633/maps File opened for reading /proc/763/maps File opened for reading /proc/926/maps File opened for reading /proc/721/maps File opened for reading /proc/8/maps File opened for reading /proc/17/maps -
Changes its process name 1 IoCs
description pid Changes the process name, possibly in an attempt to hide itself 1577 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp -
description ioc File opened for reading /proc/1565/maps File opened for reading /proc/377/fd File opened for reading /proc/1582/maps File opened for reading /proc/1101/maps File opened for reading /proc/1136/maps File opened for reading /proc/1215/maps File opened for reading /proc/1376/maps File opened for reading /proc/1078/maps File opened for reading /proc/1100/maps File opened for reading /proc/1202/maps File opened for reading /proc/1231/maps File opened for reading /proc/1314/maps File opened for reading /proc/1360/maps File opened for reading /proc/1060/maps File opened for reading /proc/417/fd File opened for reading /proc/1120/maps File opened for reading /proc/1104/maps File opened for reading /proc/1206/maps File opened for reading /proc/1499/maps File opened for reading /proc/1566/maps File opened for reading /proc/1/fd File opened for reading /proc/1115/maps File opened for reading /proc/1180/maps File opened for reading /proc/1225/maps File opened for reading /proc/1022/maps File opened for reading /proc/1113/maps File opened for reading /proc/1220/maps File opened for reading /proc/1324/maps File opened for reading /proc/1067/maps File opened for reading /proc/426/fd File opened for reading /proc/1256/maps File opened for reading /proc/1567/maps File opened for reading /proc/1098/maps File opened for reading /proc/1586/maps File opened for reading /proc/1379/maps File opened for reading /proc/1438/maps File opened for reading /proc/1542/maps File opened for reading /proc/1032/maps File opened for reading /proc/1041/maps File opened for reading /proc/1048/maps File opened for reading /proc/1008/maps File opened for reading /proc/1025/maps File opened for reading /proc/1105/maps File opened for reading /proc/530/fd File opened for reading /proc/1445/maps File opened for reading /proc/1580/maps File opened for reading /proc/1587/maps File opened for reading /proc/1102/maps File opened for reading /proc/1137/maps File opened for reading /proc/531/fd File opened for reading /proc/1581/maps File opened for reading /proc/1024/maps File opened for reading /proc/1083/maps File opened for reading /proc/1103/maps File opened for reading /proc/1106/maps File opened for reading /proc/1109/maps File opened for reading /proc/1131/maps File opened for reading /proc/1167/maps File opened for reading /proc/1196/maps File opened for reading /proc/1011/maps File opened for reading /proc/450/fd File opened for reading /proc/1195/maps File opened for reading /proc/1460/maps File opened for reading /proc/1099/maps