Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20250307-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20250307-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
10/03/2025, 00:52
Behavioral task
behavioral1
Sample
nabx86.elf
Resource
ubuntu2204-amd64-20250307-en
ubuntu-22.04-amd64
General
-
Target
nabx86.elf
-
Size
34KB
-
MD5
a772569a4d256423bd1c03ca65a63edd
-
SHA1
4240d67b0b700cd83b221f518cafca21c48ce50b
-
SHA256
049941c6c5af46bf841f6c74df053d9863f1e9b3f1badf93c7e5c1ff390dd834
-
SHA512
cfffe530fcb2f53cc4bfc935110c931140f1359ab32453e1d2591bfd341367f22212208436be962091dff90bedf0122ed1934795983c3486f6b5e0223f553218
-
SSDEEP
384:fVcMy41Py+KevyMeTZEKS6oBHEUUyTu1zxUHWwYRKKfIDis3x1d2yL1lgS9BmXOU:Yn+TgTZ2t4+HWwOUhXVLpmXOH9n/
Malware Config
Signatures
-
Contacts a large (14694) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Renames itself 1 IoCs
pid 1561 -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 81.169.136.222 -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself gdm3 1561 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp -
description ioc File opened for reading /proc/5/comm File opened for reading /proc/113/comm File opened for reading /proc/223/comm File opened for reading /proc/311/comm File opened for reading /proc/1095/comm File opened for reading /proc/1387/comm File opened for reading /proc/584/status File opened for reading /proc/81/comm File opened for reading /proc/91/comm File opened for reading /proc/1031/comm File opened for reading /proc/1238/comm File opened for reading /proc/1430/comm File opened for reading /proc/756/status File opened for reading /proc/1095/status File opened for reading /proc/1104/status File opened for reading /proc/404/comm File opened for reading /proc/519/comm File opened for reading /proc/602/comm File opened for reading /proc/605/comm File opened for reading /proc/675/status File opened for reading /proc/1242/status File opened for reading /proc/1253/status File opened for reading /proc/79/comm File opened for reading /proc/95/comm File opened for reading /proc/590/comm File opened for reading /proc/1046/comm File opened for reading /proc/1088/comm File opened for reading /proc/1168/comm File opened for reading /proc/784/comm File opened for reading /proc/605/status File opened for reading /proc/1238/status File opened for reading /proc/1369/status File opened for reading /proc/77/comm File opened for reading /proc/97/comm File opened for reading /proc/210/comm File opened for reading /proc/213/comm File opened for reading /proc/582/comm File opened for reading /proc/1463/comm File opened for reading /proc/1119/comm File opened for reading /proc/1333/status File opened for reading /proc/101/comm File opened for reading /proc/209/comm File opened for reading /proc/631/comm File opened for reading /proc/927/comm File opened for reading /proc/1549/comm File opened for reading /proc/732/status File opened for reading /proc/795/status File opened for reading /proc/1088/status File opened for reading /proc/259/comm File opened for reading /proc/760/comm File opened for reading /proc/1126/comm File opened for reading /proc/649/status File opened for reading /proc/786/status File opened for reading /proc/1053/status File opened for reading /proc/1174/status File opened for reading /proc/1178/status File opened for reading /proc/771/comm File opened for reading /proc/99/comm File opened for reading /proc/712/comm File opened for reading /proc/1169/comm File opened for reading /proc/1242/comm File opened for reading /proc/771/status File opened for reading /proc/1189/status File opened for reading /proc/1312/status