Analysis
-
max time kernel
29s -
max time network
30s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20250307-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20250307-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
19/03/2025, 06:20
Behavioral task
behavioral1
Sample
hoho.x86
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
hoho.x86
Resource
ubuntu2004-amd64-20241127-en
ubuntu-20.04-amd64
Behavioral task
behavioral3
Sample
hoho.x86
Resource
ubuntu2204-amd64-20250307-en
ubuntu-22.04-amd64
General
-
Target
hoho.x86
-
Size
44KB
-
MD5
e30a2268e4e7b1466396bf4765c1a71a
-
SHA1
9b981f58e57f94e88259f7d258c0890167b98d81
-
SHA256
f2c88c292dda473ca4c29ba6e96e57d2ac1ce861f344409f686d78ad1ed2be60
-
SHA512
25a1a76cb3ade2208d5c7ccb3f77d532ba2efca74b95ef1f7bf0dd37d305d6267349a06541553b57977dff91dec9e3c23561482a4935dc7a5e12d47403ed5f7b
-
SSDEEP
768:gjo8WnBsux3TUi32+4qbBYSWLg49InbnHYMbJoSFO+Meb4atC:gWBsux3TUiG9qbBYSWv9IjY8JoSFO+1F
Malware Config
Signatures
-
Contacts a large (70379) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description pid Changes the process name, possibly in an attempt to hide itself 1568 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp -
description ioc File opened for reading /proc/749/fd File opened for reading /proc/924/fd File opened for reading /proc/1013/fd File opened for reading /proc/1050/fd File opened for reading /proc/1100/fd File opened for reading /proc/1125/fd File opened for reading /proc/585/fd File opened for reading /proc/735/fd File opened for reading /proc/998/fd File opened for reading /proc/1134/fd File opened for reading /proc/1187/fd File opened for reading /proc/1206/fd File opened for reading /proc/1217/fd File opened for reading /proc/1339/fd File opened for reading /proc/546/fd File opened for reading /proc/739/fd File opened for reading /proc/886/fd File opened for reading /proc/892/fd File opened for reading /proc/949/fd File opened for reading /proc/1026/fd File opened for reading /proc/1095/fd File opened for reading /proc/1097/fd File opened for reading /proc/609/fd File opened for reading /proc/612/fd File opened for reading /proc/635/fd File opened for reading /proc/796/fd File opened for reading /proc/989/fd File opened for reading /proc/1027/fd File opened for reading /proc/1035/fd File opened for reading /proc/1224/fd File opened for reading /proc/377/fd File opened for reading /proc/1041/fd File opened for reading /proc/1068/fd File opened for reading /proc/1079/fd File opened for reading /proc/1101/fd File opened for reading /proc/1174/fd File opened for reading /proc/1413/fd File opened for reading /proc/1444/fd File opened for reading /proc/592/fd File opened for reading /proc/639/fd File opened for reading /proc/771/fd File opened for reading /proc/1061/fd File opened for reading /proc/1410/fd File opened for reading /proc/557/fd File opened for reading /proc/587/fd File opened for reading /proc/613/fd File opened for reading /proc/721/fd File opened for reading /proc/772/fd File opened for reading /proc/1110/fd File opened for reading /proc/1394/fd File opened for reading /proc/1491/fd File opened for reading /proc/665/fd File opened for reading /proc/731/fd File opened for reading /proc/740/fd File opened for reading /proc/1093/fd File opened for reading /proc/1094/fd File opened for reading /proc/1102/fd File opened for reading /proc/1123/fd File opened for reading /proc/1510/fd File opened for reading /proc/1/fd File opened for reading /proc/689/fd File opened for reading /proc/766/fd File opened for reading /proc/800/fd File opened for reading /proc/980/fd