Analysis
- max time kernel
149s - max time network
151s - platform
ubuntu-24.04_amd64 - resource
ubuntu2404-amd64-20250610-en - resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20250610-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system - submitted
16/06/2025, 04:26
Static task
static1
Behavioral task
behavioral1
Sample
x86_64.elf
Resource
ubuntu2404-amd64-20250610-en
ubuntu-24.04-amd64
8 signatures
150 seconds
General
- Target x86_64.elf
- Size 80KB
- Sample250616-e22wtstnz9
- SHA256 71fc57877fc30df8701b5074ea6ae938e8aa85935da4a308d2e5fa4a6cde4a9b
- MD5 521891166292f39ddb5b967e585e44d6
- SHA1 76af06c6567f2aca34315ead214e40a191f9e773
- SHA512 265b6cd6099a2bebf2c730d9b797aa248b993f6499f2a5052b6633aa775f1141cabcdab7c78aa51cf28e2d964d8db2536abc48a346232bb64ba55858d342996b
- SSDEEP 1536:jrKzUiCV1pLVfwRenyrhZ6Y7K3DD+7TSiZHBsTi:/Kz8fuRcMK3v+tii
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Contacts a large (4376) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route x86_64.elf - Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/135/maps x86_64.elf File opened for reading /proc/137/maps x86_64.elf File opened for reading /proc/759/maps x86_64.elf File opened for reading /proc/2/maps x86_64.elf File opened for reading /proc/55/maps x86_64.elf File opened for reading /proc/138/maps x86_64.elf File opened for reading /proc/195/maps x86_64.elf File opened for reading /proc/506/maps x86_64.elf File opened for reading /proc/763/maps x86_64.elf File opened for reading /proc/4/maps x86_64.elf File opened for reading /proc/11/maps x86_64.elf File opened for reading /proc/127/maps x86_64.elf File opened for reading /proc/130/maps x86_64.elf File opened for reading /proc/417/maps x86_64.elf File opened for reading /proc/455/maps x86_64.elf File opened for reading /proc/9/maps x86_64.elf File opened for reading /proc/12/maps x86_64.elf File opened for reading /proc/29/maps x86_64.elf File opened for reading /proc/430/maps x86_64.elf File opened for reading /proc/823/maps x86_64.elf File opened for reading /proc/42/maps x86_64.elf File opened for reading /proc/53/maps x86_64.elf File opened for reading /proc/128/maps x86_64.elf File opened for reading /proc/275/maps x86_64.elf File opened for reading /proc/512/maps x86_64.elf File opened for reading /proc/16/maps x86_64.elf File opened for reading /proc/19/maps x86_64.elf File opened for reading /proc/35/maps x86_64.elf File opened for reading /proc/37/maps x86_64.elf File opened for reading /proc/43/maps x86_64.elf File opened for reading /proc/47/maps x86_64.elf File opened for reading /proc/48/maps x86_64.elf File opened for reading /proc/71/maps x86_64.elf File opened for reading /proc/50/maps x86_64.elf File opened for reading /proc/54/maps x86_64.elf File opened for reading /proc/63/maps x86_64.elf File opened for reading /proc/24/maps x86_64.elf File opened for reading /proc/25/maps x86_64.elf File opened for reading /proc/27/maps x86_64.elf File opened for reading /proc/8/maps x86_64.elf File opened for reading /proc/18/maps x86_64.elf File opened for reading /proc/21/maps x86_64.elf File opened for reading /proc/22/maps x86_64.elf File opened for reading /proc/23/maps x86_64.elf File opened for reading /proc/26/maps x86_64.elf File opened for reading /proc/31/maps x86_64.elf File opened for reading /proc/72/maps x86_64.elf File opened for reading /proc/202/maps x86_64.elf File opened for reading /proc/235/maps x86_64.elf File opened for reading /proc/10/maps x86_64.elf File opened for reading /proc/30/maps x86_64.elf File opened for reading /proc/32/maps x86_64.elf File opened for reading /proc/129/maps x86_64.elf File opened for reading /proc/141/maps x86_64.elf File opened for reading /proc/385/maps x86_64.elf File opened for reading /proc/390/maps x86_64.elf File opened for reading /proc/576/maps x86_64.elf File opened for reading /proc/6/maps x86_64.elf File opened for reading /proc/36/maps x86_64.elf File opened for reading /proc/52/maps x86_64.elf File opened for reading /proc/65/maps x86_64.elf File opened for reading /proc/513/maps x86_64.elf File opened for reading /proc/585/maps x86_64.elf File opened for reading /proc/770/maps x86_64.elf - Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 2051 x86_64.elf - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route x86_64.elf -
description ioc Process File opened for reading /proc/1379/maps x86_64.elf File opened for reading /proc/1811/maps x86_64.elf File opened for reading /proc/3158/maps x86_64.elf File opened for reading /proc/3901/maps x86_64.elf File opened for reading /proc/8782/maps x86_64.elf File opened for reading /proc/8790/maps x86_64.elf File opened for reading /proc/9266/maps x86_64.elf File opened for reading /proc/1028/maps x86_64.elf File opened for reading /proc/1829/maps x86_64.elf File opened for reading /proc/2424/maps x86_64.elf File opened for reading /proc/9273/maps x86_64.elf File opened for reading /proc/1002/maps x86_64.elf File opened for reading /proc/1493/maps x86_64.elf File opened for reading /proc/1673/maps x86_64.elf File opened for reading /proc/2180/maps x86_64.elf File opened for reading /proc/4124/maps x86_64.elf File opened for reading /proc/8046/maps x86_64.elf File opened for reading /proc/8539/maps x86_64.elf File opened for reading /proc/8775/maps x86_64.elf File opened for reading /proc/3403/maps x86_64.elf File opened for reading /proc/3639/maps x86_64.elf File opened for reading /proc/4129/maps x86_64.elf File opened for reading /proc/4138/maps x86_64.elf File opened for reading /proc/1060/maps x86_64.elf File opened for reading /proc/1437/maps x86_64.elf File opened for reading /proc/2911/maps x86_64.elf File opened for reading /proc/7788/maps x86_64.elf File opened for reading /proc/1086/maps x86_64.elf File opened for reading /proc/1414/maps x86_64.elf File opened for reading /proc/1677/maps x86_64.elf File opened for reading /proc/2176/maps x86_64.elf File opened for reading /proc/2189/maps x86_64.elf File opened for reading /proc/2441/maps x86_64.elf File opened for reading /proc/2667/maps x86_64.elf File opened for reading /proc/8306/maps x86_64.elf File opened for reading /proc/1380/maps x86_64.elf File opened for reading /proc/1444/maps x86_64.elf File opened for reading /proc/1497/maps x86_64.elf File opened for reading /proc/2910/maps x86_64.elf File opened for reading /proc/7793/maps x86_64.elf File opened for reading /proc/8048/maps x86_64.elf File opened for reading /proc/8544/maps x86_64.elf File opened for reading /proc/8545/maps x86_64.elf File opened for reading /proc/2683/maps x86_64.elf File opened for reading /proc/8045/maps x86_64.elf File opened for reading /proc/8053/maps x86_64.elf File opened for reading /proc/8531/maps x86_64.elf File opened for reading /proc/8785/maps x86_64.elf File opened for reading /proc/8788/maps x86_64.elf File opened for reading /proc/9026/maps x86_64.elf File opened for reading /proc/9031/maps x86_64.elf File opened for reading /proc/1096/maps x86_64.elf File opened for reading /proc/2177/maps x86_64.elf File opened for reading /proc/4137/maps x86_64.elf File opened for reading /proc/9032/maps x86_64.elf File opened for reading /proc/9262/maps x86_64.elf File opened for reading /proc/9263/maps x86_64.elf File opened for reading /proc/9264/maps x86_64.elf File opened for reading /proc/9270/maps x86_64.elf File opened for reading /proc/1841/maps x86_64.elf File opened for reading /proc/2680/maps x86_64.elf File opened for reading /proc/7917/maps x86_64.elf File opened for reading /proc/8533/maps x86_64.elf File opened for reading /proc/self/maps x86_64.elf