Analysis
-
max time kernel
143s -
max time network
146s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20250410-en -
resource tags
-
submitted
11/04/2025, 09:10
General
-
Target
病毒样本/34c537210dbdbf28f4694142490b86b3
-
Size
60KB
-
MD5
34c537210dbdbf28f4694142490b86b3
-
SHA1
6218fa30427c5f9ddcef4ae1b69a69dc786071c4
-
SHA256
528e661e0fbbb7717a37de8232d6dff246bd4fd4bc310593040b7999708d4312
-
SHA512
dde401244ed91da99c5363b0930642ff2953ec57caec88f2183ffe4c62207696490083ca7ca1113e726ac644cfbc9f63f77bd7480b41b8eb6d0c26708b3a0450
-
SSDEEP
1536:/wPnZ9RD1ACbOghIB0YyEjepoV9SItxOZ1NVTjV:ovZeYOguB0YyEiISItgZ1bP
Malware Config
Signatures
-
Contacts a large (8160) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.