Analysis
-
max time kernel
132s -
max time network
151s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
28/03/2025, 00:26
Behavioral task
behavioral1
Sample
g4za.x86
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
g4za.x86
Resource
ubuntu2004-amd64-20240611-en
ubuntu-20.04-amd64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
g4za.x86
Resource
ubuntu2204-amd64-20250307-en
ubuntu-22.04-amd64
9 signatures
150 seconds
General
-
Target
g4za.x86
-
Size
73KB
-
MD5
6e6e1cb80bda1d51af6f8d328ce42660
-
SHA1
bf3dfdded3080eed20c455899c52c2f042d7b63b
-
SHA256
1c7ec27edb1e1b5bce7ce676777a0dd9e0bf709db0acaf7053b12b38ec03fb6c
-
SHA512
f694618767a0b01cf0fe84474b1ba8a0cb3074857b05fcab2095bf283d1899b9d3f3b3b4403d53b464361e6398bf35da82694e606d358934a3608b0598d086e8
-
SSDEEP
1536:GD8VBnK13Rg74kwVJStv0qkxAOHItu9ApGZp8GXPTbVhid/Sb:G0BKRRg74kWS90q9k4uGsj8G7ZUdc
Score
9/10
Malware Config
Signatures
-
Contacts a large (122839) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 37 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc File opened for reading /proc/435/maps File opened for reading /proc/445/maps File opened for reading /proc/586/maps File opened for reading /proc/625/maps File opened for reading /proc/633/maps File opened for reading /proc/709/maps File opened for reading /proc/940/maps File opened for reading /proc/442/maps File opened for reading /proc/699/maps File opened for reading /proc/701/maps File opened for reading /proc/947/maps File opened for reading /proc/449/maps File opened for reading /proc/429/maps File opened for reading /proc/431/maps File opened for reading /proc/447/maps File opened for reading /proc/459/maps File opened for reading /proc/501/maps File opened for reading /proc/479/maps File opened for reading /proc/517/maps File opened for reading /proc/960/maps File opened for reading /proc/444/maps File opened for reading /proc/468/maps File opened for reading /proc/664/maps File opened for reading /proc/949/maps File opened for reading /proc/952/maps File opened for reading /proc/407/maps File opened for reading /proc/529/maps File opened for reading /proc/559/maps File opened for reading /proc/870/maps File opened for reading /proc/645/maps File opened for reading /proc/656/maps File opened for reading /proc/473/maps File opened for reading /proc/451/maps File opened for reading /proc/502/maps File opened for reading /proc/536/maps File opened for reading /proc/587/maps File opened for reading /proc/624/maps -
Changes its process name 1 IoCs
description pid Changes the process name, possibly in an attempt to hide itself 1475 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp -
description ioc File opened for reading /proc/1575/maps File opened for reading /proc/1286/maps File opened for reading /proc/1364/maps File opened for reading /proc/1004/maps File opened for reading /proc/1226/maps File opened for reading /proc/1279/maps File opened for reading /proc/1009/maps File opened for reading /proc/1060/maps File opened for reading /proc/1161/maps File opened for reading /proc/1179/maps File opened for reading /proc/1533/maps File opened for reading /proc/1136/maps File opened for reading /proc/1144/maps File opened for reading /proc/1154/maps File opened for reading /proc/1519/maps File opened for reading /proc/1547/maps File opened for reading /proc/1053/maps File opened for reading /proc/1057/maps File opened for reading /proc/1121/maps File opened for reading /proc/1156/maps File opened for reading /proc/1167/maps File opened for reading /proc/1232/maps File opened for reading /proc/1469/maps File opened for reading /proc/1478/maps File opened for reading /proc/1503/maps File opened for reading /proc/1526/maps File opened for reading /proc/1089/maps File opened for reading /proc/1147/maps File opened for reading /proc/1301/maps File opened for reading /proc/1561/maps File opened for reading /proc/1141/maps File opened for reading /proc/1181/maps File opened for reading /proc/1471/maps File opened for reading /proc/1062/maps File opened for reading /proc/1080/maps File opened for reading /proc/1113/maps File opened for reading /proc/1172/maps File opened for reading /proc/1278/maps File opened for reading /proc/1326/maps File opened for reading /proc/1480/maps File opened for reading /proc/1510/maps File opened for reading /proc/1470/maps File opened for reading /proc/1069/maps File opened for reading /proc/1125/maps File opened for reading /proc/1129/maps File opened for reading /proc/1177/maps File opened for reading /proc/1243/maps File opened for reading /proc/1483/maps File opened for reading /proc/1495/maps File opened for reading /proc/1099/maps File opened for reading /proc/1076/maps File opened for reading /proc/1164/maps File opened for reading /proc/1186/maps File opened for reading /proc/1312/maps File opened for reading /proc/1476/maps File opened for reading /proc/1033/maps File opened for reading /proc/1334/maps File opened for reading /proc/1479/maps File opened for reading /proc/1554/maps File opened for reading /proc/1568/maps File opened for reading /proc/1258/maps File opened for reading /proc/1337/maps File opened for reading /proc/1117/maps File opened for reading /proc/1175/maps