Analysis
- max time kernel
148s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20250619-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20250619-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
10/09/2025, 03:52
Behavioral task
behavioral1
Sample
debug.elf
Resource
ubuntu1804-amd64-20250619-en
ubuntu-18.04-amd64
10 signatures
150 seconds
General
- Target debug.elf
- Size 39KB
- Sample250910-efdbcacn4t
- SHA256 ad182e8ff267cb01483e08f8756953ee63dab6fc5a0a0957febf561aedc3f0ba
- MD5 d3bc948e61d7fc83e399ba23428a2b0c
- SHA1 0139f7c1390acc3d473c91839516cf218af5f5fa
- SHA512 f333a1d37d7bf4058af1bc2da60663c1dd7da63afa40c5afe002ca386d611a952571c70736c72ab47bd9507a9e7bdd4890fc0f803d98440fe38284f67a15d0dd
- SSDEEP 768:n9rPpixVBQ0Gd7GWpEoMZnDaLJx0YpIns9w+SREhNiY+GQ0nbcuyD7UtQRje:9rPYzBFGfiDUgwgsCrm+YVQ0nouy8tyS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Mirai family
-
description ioc File deleted /var/log/audit/audit.log - Deletes journal logs 1 TTPs 2 IoCs
Deletes systemd journal logs. Likely to evade detection.
description ioc File deleted /var/log/journal/11c67417355f45d397f6be11f62e85a6/system@1aed46ce057f4a418c3dee230f4ae978-0000000000000001-000637e9b6e09d38.journal File deleted /var/log/journal/11c67417355f45d397f6be11f62e85a6/system.journal - Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
description ioc File deleted /var/log/syslog - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc File opened for reading /proc/17/maps File opened for reading /proc/29/maps File opened for reading /proc/416/maps File opened for reading /proc/576/maps File opened for reading /proc/676/maps File opened for reading /proc/946/maps File opened for reading /proc/493/maps File opened for reading /proc/967/maps File opened for reading /proc/996/maps File opened for reading /proc/3/maps File opened for reading /proc/16/maps File opened for reading /proc/176/maps File opened for reading /proc/657/maps File opened for reading /proc/15/maps File opened for reading /proc/4/maps File opened for reading /proc/12/maps File opened for reading /proc/89/maps File opened for reading /proc/559/maps File opened for reading /proc/83/maps File opened for reading /proc/36/maps File opened for reading /proc/451/maps File opened for reading /proc/605/maps File opened for reading /proc/959/maps File opened for reading /proc/2/maps File opened for reading /proc/28/maps File opened for reading /proc/168/maps File opened for reading /proc/173/maps File opened for reading /proc/921/maps File opened for reading /proc/32/maps File opened for reading /proc/450/maps File opened for reading /proc/18/maps File opened for reading /proc/160/maps File opened for reading /proc/161/maps File opened for reading /proc/166/maps File opened for reading /proc/413/maps File opened for reading /proc/963/maps File opened for reading /proc/976/maps File opened for reading /proc/987/maps File opened for reading /proc/14/maps File opened for reading /proc/82/maps File opened for reading /proc/5/maps File opened for reading /proc/25/maps File opened for reading /proc/26/maps File opened for reading /proc/115/maps File opened for reading /proc/169/maps File opened for reading /proc/175/maps File opened for reading /proc/178/maps File opened for reading /proc/897/maps File opened for reading /proc/20/maps File opened for reading /proc/35/maps File opened for reading /proc/308/maps File opened for reading /proc/724/maps File opened for reading /proc/22/maps File opened for reading /proc/501/maps File opened for reading /proc/521/maps File opened for reading /proc/701/maps File opened for reading /proc/969/maps File opened for reading /proc/11/maps File opened for reading /proc/24/maps File opened for reading /proc/500/maps File opened for reading /proc/555/maps File opened for reading /proc/19/maps File opened for reading /proc/23/maps File opened for reading /proc/172/maps - Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp File opened for reading /proc/net/tcp6 -
description ioc File opened for reading /proc/28/cmdline File opened for reading /proc/1021/maps File opened for reading /proc/452/stat File opened for reading /proc/1046/stat File opened for reading /proc/173/cmdline File opened for reading /proc/539/cmdline File opened for reading /proc/701/cmdline File opened for reading /proc/1093/maps File opened for reading /proc/559/stat File opened for reading /proc/1516/stat File opened for reading /proc/164/cmdline File opened for reading /proc/1376/maps File opened for reading /proc/28/stat File opened for reading /proc/79/stat File opened for reading /proc/1515/stat File opened for reading /proc/1029/cmdline File opened for reading /proc/1089/cmdline File opened for reading /proc/1075/maps File opened for reading /proc/21/stat File opened for reading /proc/165/stat File opened for reading /proc/576/stat File opened for reading /proc/10/cmdline File opened for reading /proc/926/cmdline File opened for reading /proc/1033/cmdline File opened for reading /proc/7/stat File opened for reading /proc/25/stat File opened for reading /proc/724/stat File opened for reading /proc/1244/stat File opened for reading /proc/1510/stat File opened for reading /proc/30/cmdline File opened for reading /proc/17/stat File opened for reading /proc/701/stat File opened for reading /proc/713/stat File opened for reading /proc/501/cmdline File opened for reading /proc/996/cmdline File opened for reading /proc/13/stat File opened for reading /proc/262/stat File opened for reading /proc/904/stat File opened for reading /proc/8/cmdline File opened for reading /proc/9/cmdline File opened for reading /proc/19/cmdline File opened for reading /proc/671/cmdline File opened for reading /proc/976/cmdline File opened for reading /proc/8/stat File opened for reading /proc/907/stat File opened for reading /proc/1052/stat File opened for reading /proc/4/cmdline File opened for reading /proc/907/cmdline File opened for reading /proc/940/cmdline File opened for reading /proc/1021/cmdline File opened for reading /proc/1173/cmdline File opened for reading /proc/18/stat File opened for reading /proc/16/cmdline File opened for reading /proc/115/cmdline File opened for reading /proc/1252/cmdline File opened for reading /proc/1181/maps File opened for reading /proc/1516/maps File opened for reading /proc/1483/stat File opened for reading /proc/12/cmdline File opened for reading /proc/1181/cmdline File opened for reading /proc/1518/stat File opened for reading /proc/967/stat File opened for reading /proc/25/cmdline File opened for reading /proc/86/cmdline