Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20250307-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20250307-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
28/03/2025, 00:26
Behavioral task
behavioral1
Sample
g4za.x86
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
g4za.x86
Resource
ubuntu2004-amd64-20240611-en
ubuntu-20.04-amd64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
g4za.x86
Resource
ubuntu2204-amd64-20250307-en
ubuntu-22.04-amd64
9 signatures
150 seconds
General
-
Target
g4za.x86
-
Size
73KB
-
MD5
6e6e1cb80bda1d51af6f8d328ce42660
-
SHA1
bf3dfdded3080eed20c455899c52c2f042d7b63b
-
SHA256
1c7ec27edb1e1b5bce7ce676777a0dd9e0bf709db0acaf7053b12b38ec03fb6c
-
SHA512
f694618767a0b01cf0fe84474b1ba8a0cb3074857b05fcab2095bf283d1899b9d3f3b3b4403d53b464361e6398bf35da82694e606d358934a3608b0598d086e8
-
SSDEEP
1536:GD8VBnK13Rg74kwVJStv0qkxAOHItu9ApGZp8GXPTbVhid/Sb:G0BKRRg74kWS90q9k4uGsj8G7ZUdc
Score
9/10
Malware Config
Signatures
-
Contacts a large (125158) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 54 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc File opened for reading /proc/558/maps File opened for reading /proc/592/maps File opened for reading /proc/612/maps File opened for reading /proc/747/maps File opened for reading /proc/774/maps File opened for reading /proc/947/maps File opened for reading /proc/986/maps File opened for reading /proc/509/maps File opened for reading /proc/587/maps File opened for reading /proc/640/maps File opened for reading /proc/741/maps File opened for reading /proc/763/maps File opened for reading /proc/798/maps File opened for reading /proc/887/maps File opened for reading /proc/427/maps File opened for reading /proc/609/maps File opened for reading /proc/760/maps File opened for reading /proc/782/maps File opened for reading /proc/789/maps File opened for reading /proc/893/maps File opened for reading /proc/918/maps File opened for reading /proc/975/maps File opened for reading /proc/414/maps File opened for reading /proc/613/maps File opened for reading /proc/767/maps File opened for reading /proc/906/maps File opened for reading /proc/926/maps File opened for reading /proc/408/maps File opened for reading /proc/410/maps File opened for reading /proc/412/maps File opened for reading /proc/417/maps File opened for reading /proc/593/maps File opened for reading /proc/636/maps File opened for reading /proc/683/maps File opened for reading /proc/925/maps File opened for reading /proc/585/maps File opened for reading /proc/666/maps File opened for reading /proc/802/maps File opened for reading /proc/980/maps File opened for reading /proc/999/maps File opened for reading /proc/452/maps File opened for reading /proc/633/maps File opened for reading /proc/634/maps File opened for reading /proc/688/maps File opened for reading /proc/735/maps File opened for reading /proc/742/maps File opened for reading /proc/773/maps File opened for reading /proc/512/maps File opened for reading /proc/588/maps File opened for reading /proc/639/maps File opened for reading /proc/722/maps File opened for reading /proc/731/maps File opened for reading /proc/787/maps File opened for reading /proc/555/maps -
Changes its process name 1 IoCs
description pid Changes the process name, possibly in an attempt to hide itself 1562 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp -
description ioc File opened for reading /proc/1182/maps File opened for reading /proc/1270/maps File opened for reading /proc/1308/maps File opened for reading /proc/1612/maps File opened for reading /proc/1083/maps File opened for reading /proc/1168/maps File opened for reading /proc/1178/maps File opened for reading /proc/1236/maps File opened for reading /proc/1369/maps File opened for reading /proc/1449/maps File opened for reading /proc/1566/maps File opened for reading /proc/1620/maps File opened for reading /proc/1173/maps File opened for reading /proc/1176/maps File opened for reading /proc/1373/maps File opened for reading /proc/1586/maps File opened for reading /proc/1607/maps File opened for reading /proc/1652/maps File opened for reading /proc/1655/maps File opened for reading /proc/1663/maps File opened for reading /proc/1162/maps File opened for reading /proc/1265/maps File opened for reading /proc/1563/maps File opened for reading /proc/1599/maps File opened for reading /proc/1038/maps File opened for reading /proc/1043/maps File opened for reading /proc/1045/maps File opened for reading /proc/1158/maps File opened for reading /proc/1163/maps File opened for reading /proc/1221/maps File opened for reading /proc/1235/maps File opened for reading /proc/1260/maps File opened for reading /proc/1073/maps File opened for reading /proc/1550/maps File opened for reading /proc/1615/maps File opened for reading /proc/1631/maps File opened for reading /proc/1636/maps File opened for reading /proc/1674/maps File opened for reading /proc/1134/maps File opened for reading /proc/1161/maps File opened for reading /proc/1165/maps File opened for reading /proc/1196/maps File opened for reading /proc/1309/maps File opened for reading /proc/1589/maps File opened for reading /proc/1596/maps File opened for reading /proc/1623/maps File opened for reading /proc/1320/maps File opened for reading /proc/1430/maps File opened for reading /proc/1526/maps File opened for reading /proc/1504/maps File opened for reading /proc/1147/maps File opened for reading /proc/1184/maps File opened for reading /proc/1191/maps File opened for reading /proc/1250/maps File opened for reading /proc/1639/maps File opened for reading /proc/1671/maps File opened for reading /proc/1177/maps File opened for reading /proc/1246/maps File opened for reading /proc/1354/maps File opened for reading /proc/1580/maps File opened for reading /proc/1644/maps File opened for reading /proc/1097/maps File opened for reading /proc/1145/maps File opened for reading /proc/1159/maps