Overview
overview
10Static
static
6042fe062e9...f4.elf
debian-12-armhf
604614935b4...43e.sh
ubuntu-18.04-amd64
704614935b4...43e.sh
debian-9-armhf
704614935b4...43e.sh
debian-9-mips
04614935b4...43e.sh
debian-9-mipsel
1737369bee...fd.exe
windows10-2004-x64
101ca3b90193...3f.elf
debian-12-mipsel
134d2e47fa8...cc9.sh
ubuntu-18.04-amd64
734d2e47fa8...cc9.sh
debian-9-armhf
734d2e47fa8...cc9.sh
debian-9-mips
34d2e47fa8...cc9.sh
debian-9-mipsel
404df61aa1...69.elf
ubuntu-18.04-amd64
64778d350b0...c8.exe
windows10-2004-x64
74778d350b0...c8.exe
windows11-ltsc_2024-x64
7533ab567df...582.sh
ubuntu-18.04-amd64
8533ab567df...582.sh
debian-9-armhf
8533ab567df...582.sh
debian-9-mips
533ab567df...582.sh
debian-9-mipsel
68bd196353...b9.elf
ubuntu-18.04-amd64
68bd196353...b9.elf
debian-9-armhf
68bd196353...b9.elf
debian-9-mips
68bd196353...b9.elf
debian-9-mipsel
94fdbdfea6...4d.elf
ubuntu-18.04-amd64
94fdbdfea6...4d.elf
debian-9-armhf
94fdbdfea6...4d.elf
debian-9-mips
94fdbdfea6...4d.elf
debian-9-mipsel
b66cde24a5...3d.elf
ubuntu-18.04-amd64
6e4697c7022...19.elf
debian-12-armhf
1ef5d4d0fbf...b6.elf
ubuntu-18.04-amd64
4ffb744e915...8f.elf
ubuntu-18.04-amd64
1Analysis
- max time kernel
150s - max time network
153s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
31/07/2026, 13:47
Static task
static1
Behavioral task
behavioral1
Sample
042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
Behavioral task
behavioral2
Sample
04614935b46d278acf30fbd275dfa2b55e19a1a96ece17be852325305469343e.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral3
Sample
04614935b46d278acf30fbd275dfa2b55e19a1a96ece17be852325305469343e.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral4
Sample
04614935b46d278acf30fbd275dfa2b55e19a1a96ece17be852325305469343e.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral5
Sample
04614935b46d278acf30fbd275dfa2b55e19a1a96ece17be852325305469343e.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral6
Sample
1737369bee038e31b39e2cb66b9dd18ecbec92a7be1324adc16060682141f2fd.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
1ca3b901935fead67478eae99eaf7061c871fc0fcea3403086a0c5cc154c1f3f.elf
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
Behavioral task
behavioral8
Sample
34d2e47fa8f6b64e346623b4ed66898b86d53891900b953e69f02e2b3ffb2cc9.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral9
Sample
34d2e47fa8f6b64e346623b4ed66898b86d53891900b953e69f02e2b3ffb2cc9.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral10
Sample
34d2e47fa8f6b64e346623b4ed66898b86d53891900b953e69f02e2b3ffb2cc9.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral11
Sample
34d2e47fa8f6b64e346623b4ed66898b86d53891900b953e69f02e2b3ffb2cc9.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral12
Sample
404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral13
Sample
4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral16
Sample
533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral17
Sample
533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral18
Sample
533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral19
Sample
68bd19635359188ea8ab42541ba0e573b34a1819fde6115e8dced39c4ebd97b9.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
68bd19635359188ea8ab42541ba0e573b34a1819fde6115e8dced39c4ebd97b9.elf
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral21
Sample
68bd19635359188ea8ab42541ba0e573b34a1819fde6115e8dced39c4ebd97b9.elf
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral22
Sample
68bd19635359188ea8ab42541ba0e573b34a1819fde6115e8dced39c4ebd97b9.elf
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral23
Sample
94fdbdfea6c70f8d83acf32f495584ff7a25c9270bfb36fe045eb43efb7ac04d.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral24
Sample
94fdbdfea6c70f8d83acf32f495584ff7a25c9270bfb36fe045eb43efb7ac04d.elf
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral25
Sample
94fdbdfea6c70f8d83acf32f495584ff7a25c9270bfb36fe045eb43efb7ac04d.elf
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral26
Sample
94fdbdfea6c70f8d83acf32f495584ff7a25c9270bfb36fe045eb43efb7ac04d.elf
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral27
Sample
b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral28
Sample
e4697c702263e186097be61c198ffc5a148631b1d3db08f2b515c1b742f8e919.elf
Resource
debian12-armhf-20260127-en
debian-12-armhf
Behavioral task
behavioral29
Sample
ef5d4d0fbfd73d3e50607ac5f62287ec6f9045ce6fb5940afeab6bb2601b0cb6.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral30
Sample
ffb744e91515a6bdb0bf0588065455efd591250c882026b6c16f6afca11ca98f.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
General
- Target 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf
- Size 141KB
- Sample260731-q3hecsvxcs
- SHA256 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4
- MD5 c72135657e0355918cc2d3144204c0ce
- SHA1 73dadd2bf06ed596bee8696926399c0712067949
- SHA512 1c6b7e766284d656c3c620294c8ba1e9389faa0ee6d4cf02e98fcca0786231fd33a4f627fe2a417ee080373049c6900b6e3ba0e7373baf9381058e76c6233a64
- SSDEEP 3072:KdqfO+OGhF+094Vnrykp7IPzauLhZ6tQC+KCUlEWU+oxFoAC2:KmjthF+0MOkKPzauLhZ6tQ1KCDW1+oAh
- TLSH T1D4E3185AB9519F12D5C321FAFB9F814933136FB8E3F93102DD206F60278A99B0E76512
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/2/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/9/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/32/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/613/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/7/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/11/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/337/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/10/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/33/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/35/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/36/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/42/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/661/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/668/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/6/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/28/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/34/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/142/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/787/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/44/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/313/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/367/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/615/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/799/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/24/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/29/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/3/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/20/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/340/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/721/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/727/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/12/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/26/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/27/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/18/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/51/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/57/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/143/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/193/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/254/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/359/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/788/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/198/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/316/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/798/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/4/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/14/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/16/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/22/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/73/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/638/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/21/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/216/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/355/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/19/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/30/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/31/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/315/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/637/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/794/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/8/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/45/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/789/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/801/maps 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf - Changes its process name 3 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself netns 793 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf Changes the process name, possibly in an attempt to hide itself rcu_sched 793 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf Changes the process name, possibly in an attempt to hide itself kcompactd0 798 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf - Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/net/tcp6 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf -
description ioc Process File opened for reading /proc/4/stat 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/20/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/25/stat 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/36/stat 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/44/cmdline 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/57/cmdline 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/26/stat 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/32/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/46/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/787/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/799/stat 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/14/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/18/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/784/stat 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/800/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/355/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/25/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/355/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/12/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/33/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/661/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/16/stat 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/34/stat 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/20/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/22/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/56/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/313/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/2/stat 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/313/cmdline 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/2/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/18/stat 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/26/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/33/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/35/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/35/stat 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/29/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/57/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/615/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/16/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/27/cmdline 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/799/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/316/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/2/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/51/stat 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/340/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/661/cmdline 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/193/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/17/stat 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/23/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/26/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/42/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/8/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/56/cmdline 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/73/stat 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/315/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/340/cmdline 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/613/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/20/cmdline 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/45/comm 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/143/stat 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/73/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/143/fd 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/23/cmdline 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf File opened for reading /proc/26/cmdline 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.d_lock 042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf
Processes
-
/tmp/042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf/tmp/042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf1⤵
- Enumerates active TCP sockets
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:790 -
/bin/sh/bin/sh -c "iptables -A OUTPUT -d 79.143.191.7 -j ACCEPT 2>/dev/null"2⤵PID:800
-
-
/bin/sh/bin/sh -c "iptables -A INPUT -s 79.143.191.7 -j ACCEPT 2>/dev/null"2⤵PID:801
-