Analysis
- max time kernel
149s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20250619-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20250619-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
04/11/2025, 02:29
General
- Target SecuriteInfo.com.Trojan.Linux.Gafgyt.5047.25328.elf
- Size 59KB
- Sample251104-cyynwsbj2x
- SHA256 08cdcf144219f119d50b977721175b667c7d2acecc2cf313cb76312e5db541da
- MD5 bfe70a1a6691484117f36f5072d5fbf9
- SHA1 fa1f8aa374a480a68c70fd5725ab02a62567d1f5
- SHA512 c420760a98ad5dcbcfe23bbdee63a694906f3e7b8223b4f5cf954bd41c0887e9bc84f67c72b7b26075b5e37659f5510611d24fd567ad6659f0744e914f03ecd2
- SSDEEP 1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASRY65qqLkg4azHp:CM5az1Fy0oPgdZX6hTo8RSzqLGazHp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc File opened for reading /sys/class/dmi/id/product_name - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc File opened for reading /proc/net/tcp - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself /usr/lib/packagekit/packagekitd 1504 - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/tcp -
description ioc File opened for reading /proc/22/cmdline File opened for reading /proc/1125/status File opened for reading /proc/1304/comm File opened for reading /proc/487/comm File opened for reading /proc/23/cmdline File opened for reading /proc/86/comm File opened for reading /proc/159/cmdline File opened for reading /proc/164/comm File opened for reading /proc/171/cmdline File opened for reading /proc/317/cmdline File opened for reading /proc/1078/comm File opened for reading /proc/464/cmdline File opened for reading /proc/643/status File opened for reading /proc/645/comm File opened for reading /proc/661/cmdline File opened for reading /proc/79/cmdline File opened for reading /proc/246/cmdline File opened for reading /proc/1019/comm File opened for reading /proc/1046/cmdline File opened for reading /proc/446/cmdline File opened for reading /proc/7/comm File opened for reading /proc/32/cmdline File opened for reading /proc/89/comm File opened for reading /proc/137/cmdline File opened for reading /proc/172/cmdline File opened for reading /proc/204/cmdline File opened for reading /proc/705/cmdline File opened for reading /proc/643/comm File opened for reading /proc/13/comm File opened for reading /proc/7/cmdline File opened for reading /proc/170/cmdline File opened for reading /proc/173/comm File opened for reading /proc/174/cmdline File opened for reading /proc/1011/cmdline File opened for reading /proc/1032/comm File opened for reading /proc/166/comm File opened for reading /proc/14/cmdline File opened for reading /proc/22/comm File opened for reading /proc/84/comm File opened for reading /proc/89/cmdline File opened for reading /proc/175/cmdline File opened for reading /proc/1007/cmdline File opened for reading /proc/1046/status File opened for reading /proc/29/comm File opened for reading /proc/203/comm File opened for reading /proc/312/cmdline File opened for reading /proc/514/status File opened for reading /proc/916/status File opened for reading /proc/1055/comm File opened for reading /proc/1060/cmdline File opened for reading /proc/1076/status File opened for reading /proc/10/cmdline File opened for reading /proc/464/comm File opened for reading /proc/524/cmdline File opened for reading /proc/524/comm File opened for reading /proc/973/comm File opened for reading /proc/977/comm File opened for reading /proc/1023/cmdline File opened for reading /proc/1125/cmdline File opened for reading /proc/4/comm File opened for reading /proc/24/comm File opened for reading /proc/80/cmdline File opened for reading /proc/115/cmdline File opened for reading /proc/168/comm - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc File opened for modification /tmp/.bot_lock