Analysis
- max time kernel
133s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20240729-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
11/05/2025, 19:08
Behavioral task
behavioral1
Sample
navo.x86.elf
Resource
ubuntu1804-amd64-20240729-en
4 signatures
150 seconds
General
- Target navo.x86.elf
- Size 93KB
- Sample250511-xtafqagj6x
- SHA256 bdb702657db4a6fb1616b42e6a2cd457a76e48e866edeea479be35711b518447
- MD5 f94d15777a820073bff63965966c9e40
- SHA1 2bd3f1718b2ea52e30a45f59ccb9438eb3ab5ea6
- SHA512 21dfcca2a6f5afc358b316913b4e63f39c4105cf1c34bf0dfffbd0f4c5cf8ba255d355ef5c093ecd046fabb4213247343fe39ecae47cc6f77fa2277103402114
- SSDEEP 1536:KHaFVn1lCW+pZurL5ryER49X6Jc9eEonB6bSrkwPCu1Ix27FaU3h7SGHEm0S/C9u:K6FVn1lCjnuL5me49X6JcIEon0WrVauW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid 1504 - Traces itself 2 IoCs
Traces itself to prevent debugging attempts
pid 1504 1505 - Changes its process name 1 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself httpd 1504 - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc File opened for modification /tmp/navo.x86.elf