Analysis
-
max time kernel
32s -
max time network
153s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20250307-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20250307-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
09/03/2025, 15:28
Behavioral task
behavioral1
Sample
a.elf
Resource
ubuntu2204-amd64-20250307-en
ubuntu-22.04-amd64
9 signatures
150 seconds
General
-
Target
a.elf
-
Size
68KB
-
MD5
e7f92c4e413c935c0a18829ec85f0628
-
SHA1
5f9ca32a4e93a51ed8127dceb54e2e003d9cc015
-
SHA256
656258b719c63b4436a318edf0602f200cb3207ec2c664fa4647352430baeda2
-
SHA512
9f00d5e0dd1929d55d162d8d6e582ffce9fd75d8e17eae19f138f40ef0102cac87532dfd948cb10921b7f74650d6c11d04e7d3e4ceb272d867c615038eb5a32d
-
SSDEEP
1536:eBYl8ZgUNE2QstBXXJff5KWq8M2hMze5qxOq5GzfnjOaAKbiA0:AMKgUNE2QsbXJ35I8M2hMze5qxOq5GzZ
Score
9/10
Malware Config
Signatures
-
Contacts a large (209324) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc File opened for reading /proc/590/maps File opened for reading /proc/768/maps File opened for reading /proc/4/maps File opened for reading /proc/217/maps File opened for reading /proc/218/maps File opened for reading /proc/928/maps File opened for reading /proc/11/maps File opened for reading /proc/411/maps File opened for reading /proc/798/maps File opened for reading /proc/891/maps File opened for reading /proc/22/maps File opened for reading /proc/158/maps File opened for reading /proc/212/maps File opened for reading /proc/259/maps File opened for reading /proc/311/maps File opened for reading /proc/605/maps File opened for reading /proc/92/maps File opened for reading /proc/221/maps File opened for reading /proc/920/maps File opened for reading /proc/97/maps File opened for reading /proc/20/maps File opened for reading /proc/446/maps File opened for reading /proc/751/maps File opened for reading /proc/3/maps File opened for reading /proc/6/maps File opened for reading /proc/398/maps File opened for reading /proc/522/maps File opened for reading /proc/750/maps File opened for reading /proc/93/maps File opened for reading /proc/96/maps File opened for reading /proc/5/maps File opened for reading /proc/21/maps File opened for reading /proc/24/maps File opened for reading /proc/25/maps File opened for reading /proc/209/maps File opened for reading /proc/219/maps File opened for reading /proc/99/maps File opened for reading /proc/599/maps File opened for reading /proc/98/maps File opened for reading /proc/405/maps File opened for reading /proc/413/maps File opened for reading /proc/582/maps File opened for reading /proc/109/maps File opened for reading /proc/525/maps File opened for reading /proc/584/maps File opened for reading /proc/665/maps File opened for reading /proc/81/maps File opened for reading /proc/86/maps File opened for reading /proc/425/maps File opened for reading /proc/782/maps File opened for reading /proc/19/maps File opened for reading /proc/80/maps File opened for reading /proc/410/maps File opened for reading /proc/7/maps File opened for reading /proc/9/maps File opened for reading /proc/26/maps File opened for reading /proc/78/maps File opened for reading /proc/225/maps File opened for reading /proc/1/maps File opened for reading /proc/373/maps File opened for reading /proc/634/maps File opened for reading /proc/753/maps File opened for reading /proc/13/maps File opened for reading /proc/211/maps -
Changes its process name 1 IoCs
description pid Changes the process name, possibly in an attempt to hide itself 1559 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp -
description ioc File opened for reading /proc/1137/maps File opened for reading /proc/1080/maps File opened for reading /proc/1150/maps File opened for reading /proc/1246/maps File opened for reading /proc/1264/maps File opened for reading /proc/1028/maps File opened for reading /proc/1049/maps File opened for reading /proc/1175/maps File opened for reading /proc/1481/maps File opened for reading /proc/1562/maps File opened for reading /proc/1087/maps File opened for reading /proc/1094/maps File opened for reading /proc/1162/maps File opened for reading /proc/1411/maps File opened for reading /proc/1569/maps File opened for reading /proc/1171/maps File opened for reading /proc/1549/maps File opened for reading /proc/1568/maps File opened for reading /proc/413/fd File opened for reading /proc/1152/maps File opened for reading /proc/1181/maps File opened for reading /proc/1232/maps File opened for reading /proc/1547/maps File opened for reading /proc/1548/maps File opened for reading /proc/1056/maps File opened for reading /proc/1206/maps File opened for reading /proc/1370/maps File opened for reading /proc/1564/maps File opened for reading /proc/446/fd File opened for reading /proc/1157/maps File opened for reading /proc/1163/maps File opened for reading /proc/1172/maps File opened for reading /proc/1239/maps File opened for reading /proc/1442/maps File opened for reading /proc/1535/maps File opened for reading /proc/1/fd File opened for reading /proc/1126/maps File opened for reading /proc/1231/maps File opened for reading /proc/1039/maps File opened for reading /proc/522/fd File opened for reading /proc/1169/maps File opened for reading /proc/1198/maps File opened for reading /proc/1354/maps File opened for reading /proc/1563/maps File opened for reading /proc/1033/maps File opened for reading /proc/1107/maps File opened for reading /proc/1155/maps File opened for reading /proc/1166/maps File opened for reading /proc/1179/maps File opened for reading /proc/1192/maps File opened for reading /proc/1201/maps File opened for reading /proc/1243/maps File opened for reading /proc/1048/maps File opened for reading /proc/1062/maps File opened for reading /proc/1072/maps File opened for reading /proc/525/fd File opened for reading /proc/1307/maps File opened for reading /proc/1366/maps File opened for reading /proc/1119/maps File opened for reading /proc/1257/maps File opened for reading /proc/425/fd File opened for reading /proc/1088/maps File opened for reading /proc/1182/maps File opened for reading /proc/1259/maps