Analysis
-
max time kernel
35s -
max time network
25s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20250307-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20250307-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
24/03/2025, 12:23
Behavioral task
behavioral1
Sample
x86
Resource
ubuntu2204-amd64-20250307-en
ubuntu-22.04-amd64
7 signatures
150 seconds
General
-
Target
x86
-
Size
56KB
-
MD5
a7b4473399ce74c911ec86fe9f3a2295
-
SHA1
16ceb93a19944b099d8da7c0f42faa92954fd8e7
-
SHA256
5064463e3dcdc501a0cd479dcb09b24bd3bd0bf7cbacac0341f09c85f7dce81e
-
SHA512
32031eae5f5e33a5c5c3c2f97d69675e54ddc3b74f85016418d543ff2a806cf92f77ca5b5c1085e5691544ced62c1b05e4d56da01d62d0e07b5555d40d151125
-
SSDEEP
1536:l5nPRgxBusO4h25GTF005Ir45jol2DR08+OSo:qkBw25GL24+UR+Y
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 56 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc File opened for reading /proc/985/maps File opened for reading /proc/451/maps File opened for reading /proc/589/maps File opened for reading /proc/680/maps File opened for reading /proc/685/maps File opened for reading /proc/730/maps File opened for reading /proc/741/maps File opened for reading /proc/893/maps File opened for reading /proc/916/maps File opened for reading /proc/408/maps File opened for reading /proc/555/maps File opened for reading /proc/785/maps File opened for reading /proc/965/maps File opened for reading /proc/976/maps File opened for reading /proc/986/maps File opened for reading /proc/994/maps File opened for reading /proc/512/maps File opened for reading /proc/634/maps File opened for reading /proc/415/maps File opened for reading /proc/558/maps File opened for reading /proc/587/maps File opened for reading /proc/606/maps File opened for reading /proc/904/maps File opened for reading /proc/923/maps File opened for reading /proc/924/maps File opened for reading /proc/945/maps File opened for reading /proc/514/maps File opened for reading /proc/585/maps File opened for reading /proc/593/maps File opened for reading /proc/735/maps File opened for reading /proc/739/maps File opened for reading /proc/756/maps File opened for reading /proc/771/maps File opened for reading /proc/780/maps File opened for reading /proc/413/maps File opened for reading /proc/610/maps File opened for reading /proc/633/maps File opened for reading /proc/639/maps File opened for reading /proc/668/maps File opened for reading /proc/761/maps File opened for reading /proc/772/maps File opened for reading /proc/796/maps File opened for reading /proc/411/maps File opened for reading /proc/416/maps File opened for reading /proc/636/maps File opened for reading /proc/650/maps File opened for reading /proc/766/maps File opened for reading /proc/787/maps File opened for reading /proc/800/maps File opened for reading /proc/887/maps File opened for reading /proc/426/maps File opened for reading /proc/588/maps File opened for reading /proc/616/maps File opened for reading /proc/721/maps File opened for reading /proc/758/maps File opened for reading /proc/970/maps -
Changes its process name 1 IoCs
description pid Changes the process name, possibly in an attempt to hide itself 1563 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp -
description ioc File opened for reading /proc/1108/maps File opened for reading /proc/1134/maps File opened for reading /proc/1209/maps File opened for reading /proc/1345/maps File opened for reading /proc/1433/maps File opened for reading /proc/1583/maps File opened for reading /proc/1564/maps File opened for reading /proc/1030/maps File opened for reading /proc/1100/maps File opened for reading /proc/1551/maps File opened for reading /proc/1205/maps File opened for reading /proc/1373/maps File opened for reading /proc/1574/maps File opened for reading /proc/1043/maps File opened for reading /proc/1094/maps File opened for reading /proc/1107/maps File opened for reading /proc/1146/maps File opened for reading /proc/1376/maps File opened for reading /proc/1426/maps File opened for reading /proc/1035/maps File opened for reading /proc/1184/maps File opened for reading /proc/1485/maps File opened for reading /proc/1509/maps File opened for reading /proc/1163/maps File opened for reading /proc/1200/maps File opened for reading /proc/1038/maps File opened for reading /proc/1063/maps File opened for reading /proc/1236/maps File opened for reading /proc/1318/maps File opened for reading /proc/1552/maps File opened for reading /proc/1013/maps File opened for reading /proc/1025/maps File opened for reading /proc/1076/maps File opened for reading /proc/1505/maps File opened for reading /proc/1580/maps File opened for reading /proc/1056/maps File opened for reading /proc/1095/maps File opened for reading /proc/1098/maps File opened for reading /proc/1113/maps File opened for reading /proc/1116/maps File opened for reading /proc/1009/maps File opened for reading /proc/1097/maps File opened for reading /proc/1115/maps File opened for reading /proc/1117/maps File opened for reading /proc/1143/maps File opened for reading /proc/1328/maps File opened for reading /proc/1566/maps File opened for reading /proc/1567/maps File opened for reading /proc/1074/maps File opened for reading /proc/1169/maps File opened for reading /proc/1446/maps File opened for reading /proc/1012/maps File opened for reading /proc/1179/maps File opened for reading /proc/1192/maps File opened for reading /proc/1213/maps File opened for reading /proc/1103/maps File opened for reading /proc/1119/maps File opened for reading /proc/1170/maps File opened for reading /proc/1571/maps File opened for reading /proc/1096/maps File opened for reading /proc/1099/maps