2b657f06f8e78a2ec60c50b2ab486a528e7a3585fabffdf0cc21311497113a75

General

Target
2b657f06f8e78a2ec60c50b2ab486a528e7a3585fabffdf0cc21311497113a75.elf
Size 125KB
Sample260702-mxlytaex5p
SHA256 2b657f06f8e78a2ec60c50b2ab486a528e7a3585fabffdf0cc21311497113a75
MD5 93898eff562e039fa05a8dae431374d5
SHA1 714a32ff426fc0f11574d49cd24c66f4d842fbc7
SHA512 590d05c8f5f03e4f45955f82c1d1f8af639e069582202e7cb932aa5dbb7de0fa79d5731e4d7f675dff174d374b2787c3e7b628ec16c350d7bc5897f0d783721f
SSDEEP 3072:kIgrKdInOj1Rk4oNIgKm9aFXafA2vR3aLZLZ3:kIgW2nOTk4ougPCSqVd
TLSH
T1E8C35D81FAD3C1F1F6934AB10027F76B9B30DD254124CA99EBA26A71EC71D12856F36C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2b657f06f8e78a2ec60c50b2ab486a528e7a3585fabffdf0cc21311497113a75.elf
- Size 125KB
- SHA256 2b657f06f8e78a2ec60c50b2ab486a528e7a3585fabffdf0cc21311497113a75
- MD5 93898eff562e039fa05a8dae431374d5
- SHA1 714a32ff426fc0f11574d49cd24c66f4d842fbc7
- SHA512 590d05c8f5f03e4f45955f82c1d1f8af639e069582202e7cb932aa5dbb7de0fa79d5731e4d7f675dff174d374b2787c3e7b628ec16c350d7bc5897f0d783721f
- SSDEEP 3072:kIgrKdInOj1Rk4oNIgKm9aFXafA2vR3aLZLZ3:kIgW2nOTk4ougPCSqVd
- TLSH
  T1E8C35D81FAD3C1F1F6934AB10027F76B9B30DD254124CA99EBA26A71EC71D12856F36C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access defense_evasion discovery
- Deletes Audit logs
  Deletes logs related to the Linux Audit framework.
  defense_evasion
- Deletes journal logs
  Deletes systemd journal logs. Likely to evade detection.
  defense_evasion
- Deletes system logs
  Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
  defense_evasion
- Traces itself
  Traces itself to prevent debugging attempts
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads process memory
  Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
  credential_access
behavioral1