Analysis
-
max time kernel
148s -
max time network
147s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20250307-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20250307-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
23/03/2025, 02:57
Behavioral task
behavioral1
Sample
x86.elf
Resource
ubuntu2404-amd64-20250307-en
ubuntu-24.04-amd64
2 signatures
150 seconds
General
-
Target
x86.elf
-
Size
56KB
-
MD5
a7b4473399ce74c911ec86fe9f3a2295
-
SHA1
16ceb93a19944b099d8da7c0f42faa92954fd8e7
-
SHA256
5064463e3dcdc501a0cd479dcb09b24bd3bd0bf7cbacac0341f09c85f7dce81e
-
SHA512
32031eae5f5e33a5c5c3c2f97d69675e54ddc3b74f85016418d543ff2a806cf92f77ca5b5c1085e5691544ced62c1b05e4d56da01d62d0e07b5555d40d151125
-
SSDEEP
1536:l5nPRgxBusO4h25GTF005Ir45jol2DR08+OSo:qkBw25GL24+UR+Y
Score
7/10
Malware Config
Signatures
-
Loads a kernel module 64 IoCs
Loads a Linux kernel module, potentially to achieve persistence
pid Process 2490 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf 2493 x86.elf -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/bmekcjgffrbagvlv x86.elf