Overview
overview
10Static
static
6042fe062e9...f4.elf
debian-12-armhf
604614935b4...43e.sh
ubuntu-18.04-amd64
704614935b4...43e.sh
debian-9-armhf
704614935b4...43e.sh
debian-9-mips
04614935b4...43e.sh
debian-9-mipsel
1737369bee...fd.exe
windows10-2004-x64
101ca3b90193...3f.elf
debian-12-mipsel
134d2e47fa8...cc9.sh
ubuntu-18.04-amd64
734d2e47fa8...cc9.sh
debian-9-armhf
734d2e47fa8...cc9.sh
debian-9-mips
34d2e47fa8...cc9.sh
debian-9-mipsel
404df61aa1...69.elf
ubuntu-18.04-amd64
64778d350b0...c8.exe
windows10-2004-x64
74778d350b0...c8.exe
windows11-ltsc_2024-x64
7533ab567df...582.sh
ubuntu-18.04-amd64
8533ab567df...582.sh
debian-9-armhf
8533ab567df...582.sh
debian-9-mips
533ab567df...582.sh
debian-9-mipsel
68bd196353...b9.elf
ubuntu-18.04-amd64
68bd196353...b9.elf
debian-9-armhf
68bd196353...b9.elf
debian-9-mips
68bd196353...b9.elf
debian-9-mipsel
94fdbdfea6...4d.elf
ubuntu-18.04-amd64
94fdbdfea6...4d.elf
debian-9-armhf
94fdbdfea6...4d.elf
debian-9-mips
94fdbdfea6...4d.elf
debian-9-mipsel
b66cde24a5...3d.elf
ubuntu-18.04-amd64
6e4697c7022...19.elf
debian-12-armhf
1ef5d4d0fbf...b6.elf
ubuntu-18.04-amd64
4ffb744e915...8f.elf
ubuntu-18.04-amd64
1Analysis
- max time kernel
149s - max time network
140s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
31/07/2026, 13:47
Static task
static1
Behavioral task
behavioral1
Sample
042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
Behavioral task
behavioral2
Sample
04614935b46d278acf30fbd275dfa2b55e19a1a96ece17be852325305469343e.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral3
Sample
04614935b46d278acf30fbd275dfa2b55e19a1a96ece17be852325305469343e.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral4
Sample
04614935b46d278acf30fbd275dfa2b55e19a1a96ece17be852325305469343e.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral5
Sample
04614935b46d278acf30fbd275dfa2b55e19a1a96ece17be852325305469343e.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral6
Sample
1737369bee038e31b39e2cb66b9dd18ecbec92a7be1324adc16060682141f2fd.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
1ca3b901935fead67478eae99eaf7061c871fc0fcea3403086a0c5cc154c1f3f.elf
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
Behavioral task
behavioral8
Sample
34d2e47fa8f6b64e346623b4ed66898b86d53891900b953e69f02e2b3ffb2cc9.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral9
Sample
34d2e47fa8f6b64e346623b4ed66898b86d53891900b953e69f02e2b3ffb2cc9.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral10
Sample
34d2e47fa8f6b64e346623b4ed66898b86d53891900b953e69f02e2b3ffb2cc9.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral11
Sample
34d2e47fa8f6b64e346623b4ed66898b86d53891900b953e69f02e2b3ffb2cc9.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral12
Sample
404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral13
Sample
4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral16
Sample
533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral17
Sample
533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral18
Sample
533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral19
Sample
68bd19635359188ea8ab42541ba0e573b34a1819fde6115e8dced39c4ebd97b9.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
68bd19635359188ea8ab42541ba0e573b34a1819fde6115e8dced39c4ebd97b9.elf
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral21
Sample
68bd19635359188ea8ab42541ba0e573b34a1819fde6115e8dced39c4ebd97b9.elf
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral22
Sample
68bd19635359188ea8ab42541ba0e573b34a1819fde6115e8dced39c4ebd97b9.elf
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral23
Sample
94fdbdfea6c70f8d83acf32f495584ff7a25c9270bfb36fe045eb43efb7ac04d.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral24
Sample
94fdbdfea6c70f8d83acf32f495584ff7a25c9270bfb36fe045eb43efb7ac04d.elf
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral25
Sample
94fdbdfea6c70f8d83acf32f495584ff7a25c9270bfb36fe045eb43efb7ac04d.elf
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral26
Sample
94fdbdfea6c70f8d83acf32f495584ff7a25c9270bfb36fe045eb43efb7ac04d.elf
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral27
Sample
b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral28
Sample
e4697c702263e186097be61c198ffc5a148631b1d3db08f2b515c1b742f8e919.elf
Resource
debian12-armhf-20260127-en
debian-12-armhf
Behavioral task
behavioral29
Sample
ef5d4d0fbfd73d3e50607ac5f62287ec6f9045ce6fb5940afeab6bb2601b0cb6.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral30
Sample
ffb744e91515a6bdb0bf0588065455efd591250c882026b6c16f6afca11ca98f.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
General
- Target b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf
- Size 383KB
- Sample260731-q3hecsvxcs
- SHA256 b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d
- MD5 40e5e5e048690ec87d6e4ea408ee863b
- SHA1 423d4960092711ee3bd76147cbdf0ac633181773
- SHA512 82af34bf84cb2535424898005b3b2e6a523bf6f806c1209586d07e7dd3fe9c8753e8e8c2c364894867ae76a0e9afe08bcaeff4d49e4770bfb173e314ae706c67
- SSDEEP 6144:KiVEL9iGruSOwl60jkALIsYTFyJ10hspXuzKONq8LOUiqzO4JWktw5Q:KInG2v9AksC8JCYurBLOUNK4e5
- TLSH T11F844A52F2A228FDD952C930825D6123E638744943129EFB27C8EB753A16ED06F3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/36/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/162/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/163/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/174/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/178/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/404/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/456/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/476/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/679/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/554/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/956/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/11/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/13/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/24/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/89/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/12/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/485/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/6/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/453/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/513/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/544/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/954/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/20/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/28/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/593/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/640/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/17/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/29/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/270/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/566/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/3/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/18/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/32/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/21/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/412/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/490/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/895/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/79/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/82/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/165/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/31/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/654/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/83/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/204/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/692/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/995/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/7/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/159/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/166/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/317/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/653/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/888/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/890/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/967/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/987/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/475/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/592/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/14/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/26/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/78/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/84/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/176/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/406/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/27/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf - Changes its process name 3 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself edac-poller 1484 b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf Changes the process name, possibly in an attempt to hide itself khelper 1484 b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf Changes the process name, possibly in an attempt to hide itself netns 1486 b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf - Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp6 b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/net/tcp b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf -
description ioc Process File opened for reading /proc/12/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/28/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/475/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/1055/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/171/stat b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/173/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/404/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/554/comm b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/1054/comm b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/1470/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/475/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/544/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/80/stat b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/1080/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/1118/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/162/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/987/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/2/comm b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/30/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/82/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/405/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/1036/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/1290/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/3/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/453/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/1014/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/27/comm b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/631/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/1079/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/30/stat b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/82/comm b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/432/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/451/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/592/comm b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/1079/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/1182/comm b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/702/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/162/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/440/comm b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/593/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/950/comm b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/954/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/164/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/954/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/21/stat b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/86/comm b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/1043/comm b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/1444/comm b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/1254/maps b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/19/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/166/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/479/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/479/comm b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/1074/comm b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/8/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/160/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/566/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/513/comm b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/967/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/554/fd b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/25/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/81/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/931/cmdline b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf File opened for reading /proc/1486/comm b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.d_lock b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf
Processes
-
/tmp/b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf/tmp/b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf1⤵
- Enumerates active TCP sockets
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1482 -
/system/bin/shsh -c -- "iptables -A OUTPUT -d 79.143.191.7 -j ACCEPT 2>/dev/null"2⤵PID:1491
-
-
/system/bin/shsh -c -- "iptables -A INPUT -s 79.143.191.7 -j ACCEPT 2>/dev/null"2⤵PID:1492
-