Analysis
- max time kernel
146s - max time network
147s - platform
ubuntu-24.04_amd64 - resource
ubuntu2404-amd64-20250619-en - resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20250619-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system - submitted
27/07/2025, 11:13
Behavioral task
behavioral1
Sample
uYtea.x86.elf
Resource
ubuntu2404-amd64-20250619-en
ubuntu-24.04-amd64
2 signatures
150 seconds
General
- Target uYtea.x86.elf
- Size 54KB
- Sample250727-nbfeksxxcv
- SHA256 9bfc3b3296ca660a53ee14bf8def6542ca924c7501807771592275eb4b4eeb00
- MD5 baf8ede815db4c443a57646ca3ae9d03
- SHA1 66bc9ee6da12a4687e8882322701f3289bcbe088
- SHA512 377b62ab829511a2481d6a85f30ac9ce02ed3095e3be24fdaf7d9fde3029f3af2655d5ac836401be9aa8d5e3c5889ffe335aa74b383b64d7ea4f4c113b634699
- SSDEEP 768:FmnthEsW5qnF15RY1dhPe7oXTmcVDj5gk9vWnTI4eBH+4sToQLDLFv:Yn/EsW5qhSh6amWlWnU4GH+dNLt
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads a kernel module 52 IoCs
Loads a Linux kernel module, potentially to achieve persistence
pid Process 2017 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf 2018 uYtea.x86.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/DbPzmDl*\PMgy}PD uYtea.x86.elf