Analysis
-
max time kernel
139s -
max time network
149s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20250307-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20250307-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
26/03/2025, 17:09
Behavioral task
behavioral1
Sample
g4za.x86
Resource
ubuntu2204-amd64-20250307-en
ubuntu-22.04-amd64
9 signatures
150 seconds
General
-
Target
g4za.x86
-
Size
73KB
-
MD5
6e6e1cb80bda1d51af6f8d328ce42660
-
SHA1
bf3dfdded3080eed20c455899c52c2f042d7b63b
-
SHA256
1c7ec27edb1e1b5bce7ce676777a0dd9e0bf709db0acaf7053b12b38ec03fb6c
-
SHA512
f694618767a0b01cf0fe84474b1ba8a0cb3074857b05fcab2095bf283d1899b9d3f3b3b4403d53b464361e6398bf35da82694e606d358934a3608b0598d086e8
-
SSDEEP
1536:GD8VBnK13Rg74kwVJStv0qkxAOHItu9ApGZp8GXPTbVhid/Sb:G0BKRRg74kWS90q9k4uGsj8G7ZUdc
Score
9/10
Malware Config
Signatures
-
Contacts a large (125488) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 56 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc File opened for reading /proc/802/maps File opened for reading /proc/887/maps File opened for reading /proc/893/maps File opened for reading /proc/926/maps File opened for reading /proc/510/maps File opened for reading /proc/612/maps File opened for reading /proc/618/maps File opened for reading /proc/635/maps File opened for reading /proc/689/maps File opened for reading /proc/787/maps File opened for reading /proc/789/maps File opened for reading /proc/967/maps File opened for reading /proc/413/maps File opened for reading /proc/585/maps File opened for reading /proc/592/maps File opened for reading /proc/735/maps File opened for reading /proc/742/maps File opened for reading /proc/972/maps File opened for reading /proc/978/maps File opened for reading /proc/410/maps File opened for reading /proc/414/maps File opened for reading /proc/417/maps File opened for reading /proc/507/maps File opened for reading /proc/587/maps File opened for reading /proc/782/maps File opened for reading /proc/906/maps File opened for reading /proc/987/maps File opened for reading /proc/722/maps File opened for reading /proc/408/maps File opened for reading /proc/426/maps File opened for reading /proc/548/maps File opened for reading /proc/588/maps File opened for reading /proc/741/maps File opened for reading /proc/774/maps File opened for reading /proc/925/maps File opened for reading /proc/451/maps File opened for reading /proc/768/maps File opened for reading /proc/798/maps File opened for reading /proc/996/maps File opened for reading /proc/593/maps File opened for reading /proc/634/maps File opened for reading /proc/918/maps File opened for reading /proc/947/maps File opened for reading /proc/988/maps File opened for reading /proc/558/maps File opened for reading /proc/609/maps File opened for reading /proc/633/maps File opened for reading /proc/639/maps File opened for reading /proc/680/maps File opened for reading /proc/760/maps File opened for reading /proc/763/maps File opened for reading /proc/773/maps File opened for reading /proc/648/maps File opened for reading /proc/667/maps File opened for reading /proc/731/maps File opened for reading /proc/759/maps -
Changes its process name 1 IoCs
description pid Changes the process name, possibly in an attempt to hide itself 1569 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp -
description ioc File opened for reading /proc/1020/maps File opened for reading /proc/1117/maps File opened for reading /proc/1191/maps File opened for reading /proc/1570/maps File opened for reading /proc/1637/maps File opened for reading /proc/1645/maps File opened for reading /proc/1650/maps File opened for reading /proc/1011/maps File opened for reading /proc/1092/maps File opened for reading /proc/1107/maps File opened for reading /proc/1110/maps File opened for reading /proc/1167/maps File opened for reading /proc/1243/maps File opened for reading /proc/1634/maps File opened for reading /proc/1109/maps File opened for reading /proc/1198/maps File opened for reading /proc/1350/maps File opened for reading /proc/1511/maps File opened for reading /proc/1572/maps File opened for reading /proc/1577/maps File opened for reading /proc/1589/maps File opened for reading /proc/1604/maps File opened for reading /proc/1120/maps File opened for reading /proc/1331/maps File opened for reading /proc/1420/maps File opened for reading /proc/1607/maps File opened for reading /proc/1642/maps File opened for reading /proc/1025/maps File opened for reading /proc/1091/maps File opened for reading /proc/1231/maps File opened for reading /proc/1573/maps File opened for reading /proc/1202/maps File opened for reading /proc/1234/maps File opened for reading /proc/1450/maps File opened for reading /proc/1669/maps File opened for reading /proc/1037/maps File opened for reading /proc/1090/maps File opened for reading /proc/1097/maps File opened for reading /proc/1385/maps File opened for reading /proc/1574/maps File opened for reading /proc/1672/maps File opened for reading /proc/1224/maps File opened for reading /proc/1042/maps File opened for reading /proc/1096/maps File opened for reading /proc/1101/maps File opened for reading /proc/1382/maps File opened for reading /proc/1580/maps File opened for reading /proc/1615/maps File opened for reading /proc/1027/maps File opened for reading /proc/1094/maps File opened for reading /proc/1066/maps File opened for reading /proc/1283/maps File opened for reading /proc/1626/maps File opened for reading /proc/1629/maps File opened for reading /proc/1105/maps File opened for reading /proc/1152/maps File opened for reading /proc/1530/maps File opened for reading /proc/1612/maps File opened for reading /proc/1059/maps File opened for reading /proc/1077/maps File opened for reading /proc/1079/maps File opened for reading /proc/1557/maps File opened for reading /proc/1653/maps File opened for reading /proc/1661/maps