Overview

overview

10

Static

static

10

病毒样�...8fedee

ubuntu-18.04-amd64

病毒样�...8fedee

debian-9-armhf

病毒样�...8fedee

debian-9-mips

病毒样�...8fedee

debian-9-mipsel

病毒样�...f11a37

ubuntu-22.04-amd64

6

病毒样�...1a31a5

ubuntu-24.04-amd64

9

病毒样�...3d4ec8

ubuntu-18.04-amd64

病毒样�...3d4ec8

debian-9-armhf

病毒样�...3d4ec8

debian-9-mips

病毒样�...3d4ec8

debian-9-mipsel

病毒样�...abfedb

debian-12-armhf

1

病毒样�...4b233f

debian-9-mips

9

病毒样�...026956

debian-12-armhf

1

病毒样�...3abbaf

debian-12-armhf

10

病毒样�...41093c

ubuntu-18.04-amd64

病毒样�...41093c

debian-9-armhf

病毒样�...41093c

debian-9-mips

病毒样�...41093c

debian-9-mipsel

病毒样�...c23ffa

ubuntu-24.04-amd64

1

病毒样�...ef7fc4

debian-9-armhf

10

病毒样�...f0acd0

debian-12-armhf

病毒样�...04540a

ubuntu-24.04-amd64

9

病毒样�...0b86b3

ubuntu-24.04-amd64

9

病毒样�...2262e8

debian-9-armhf

1

病毒样�...f9af71

ubuntu-20.04-amd64

6

病毒样�...cfa44d

ubuntu-24.04-amd64

7

病毒样�...276606

debian-9-armhf

10

病毒样�...5d74b3

ubuntu-18.04-amd64

病毒样�...5d74b3

debian-9-armhf

病毒样�...5d74b3

debian-9-mips

病毒样�...5d74b3

debian-9-mipsel

病毒样�...6c88db

debian-12-armhf

1

Analysis

  • max time kernel
    124s
  • max time network
    151s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20250307-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20250307-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    11/04/2025, 09:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    病毒样本/0a38d9eca296fa1935f82dabb41a31a5

  • Size

    29KB

  • MD5

    0a38d9eca296fa1935f82dabb41a31a5

  • SHA1

    b36339f4e2bccfbcf3fd7f178a01b8ab210726ea

  • SHA256

    0b647a280bb064e0fcd28b65900945d08b59c98343cadd2e56d53294c112ecf3

  • SHA512

    3957ce012ddacff2606f3bde5045724566721aeb8fd84dd812b979337601d3ed7ecf728cde53cda38e1936819730780d4ea78c3b90125881e8427b8370256f50

  • SSDEEP

    384:MajMzN8f05Rpjk5Yfo2xZUzKmQAHHOvgm0PtsgV9Jz8Uaux7+fqSB+figWbETRIm:VgN8fWlfowmQA3V9qFmSBtboMAQVze

Score
9/10
discoveryrootkit

Malware Config

Signatures

  • Contacts a large (20753) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Loads a kernel module 64 IoCs

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit

Processes

  • /tmp/病毒样本/0a38d9eca296fa1935f82dabb41a31a5
    /tmp/病毒样本/0a38d9eca296fa1935f82dabb41a31a5
    1⤵
    • Loads a kernel module
    PID:2550

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads