Analysis
-
max time kernel
53s -
max time network
54s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20250307-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20250307-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
05/04/2025, 12:49
Behavioral task
behavioral1
Sample
GoldAge3ATOx86
Resource
ubuntu2204-amd64-20250307-en
General
-
Target
GoldAge3ATOx86
-
Size
37KB
-
MD5
8b02b2f0e440b7d064be3587cd61c600
-
SHA1
300c2166d2a5ff0548fc97c67fb5d57764d54be8
-
SHA256
59d3c1bc98076f369d16c99873b757d35116b13704818e0fb44e52b594671359
-
SHA512
beafe969cc4dfdb6961be229e4a2f25ab1cf4a59df6a1abf88e9d642340fcd8a9fe7d66eee3e4f17100b43a5d937eb643db1657a053a495a3546db7d09981c6a
-
SSDEEP
768:gD8ULxB2FoC8Sa3NStQGmUz3nzyeSTZ1Q4HHZx08OEsJV:gY2b2FP8Sa3NSiGmUz3uJT/rHHZxBOEs
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description pid Changes the process name, possibly in an attempt to hide itself 1550 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp -
description ioc File opened for reading /proc/631/exe File opened for reading /proc/912/exe File opened for reading /proc/634/exe File opened for reading /proc/1554/exe File opened for reading /proc/1551/exe File opened for reading /proc/424/exe File opened for reading /proc/588/exe File opened for reading /proc/607/exe File opened for reading /proc/784/exe File opened for reading /proc/894/exe File opened for reading /proc/446/exe File opened for reading /proc/502/exe File opened for reading /proc/589/exe File opened for reading /proc/608/exe File opened for reading /proc/627/exe File opened for reading /proc/692/exe File opened for reading /proc/737/exe File opened for reading /proc/760/exe File opened for reading /proc/410/exe File opened for reading /proc/590/exe File opened for reading /proc/632/exe File opened for reading /proc/672/exe File opened for reading /proc/786/exe File opened for reading /proc/796/exe File opened for reading /proc/800/exe File opened for reading /proc/404/exe File opened for reading /proc/582/exe File opened for reading /proc/665/exe File opened for reading /proc/748/exe File opened for reading /proc/756/exe File opened for reading /proc/779/exe File opened for reading /proc/887/exe File opened for reading /proc/922/exe File opened for reading /proc/408/exe File opened for reading /proc/412/exe File opened for reading /proc/522/exe File opened for reading /proc/599/exe File opened for reading /proc/728/exe File opened for reading /proc/765/exe File opened for reading /proc/770/exe File opened for reading /proc/771/exe File opened for reading /proc/644/exe File opened for reading /proc/445/exe File opened for reading /proc/584/exe File opened for reading /proc/732/exe File opened for reading /proc/743/exe File opened for reading /proc/409/exe File opened for reading /proc/503/exe File opened for reading /proc/630/exe File opened for reading /proc/523/exe