4d5fdf61242476e6f4b76c196754f55c15aec0e123f495298632181c5744e326

General

Target
4d5fdf61242476e6f4b76c196754f55c15aec0e123f495298632181c5744e326.elf
Size 91KB
Sample260822-cfq64avsez
SHA256 4d5fdf61242476e6f4b76c196754f55c15aec0e123f495298632181c5744e326
MD5 388b60ff8cd07fb544be1a8a89968e97
SHA1 d83fd0d574bc591e687e51be1ce623e8f97b4abd
SHA512 1bd4384c87ff364a4b05fb4f0434effba5c4bb2b25b2fa727bf1a93307c662396c90e2076d589f47ca75ba8b19a42771270bdb2b02445a4997a157c67bbbe6b1
SSDEEP 1536:jUKvjDS4yb87YHgtyGpZxRIMUbXyYpvaQchpA/xHip+zDe0wPv4Ox:xvnyb87YHgtpRIMYvoAeMQdx
TLSH
T1C793C55E2E319FBEF76CC23C4BB34A31A26963D923E096C1D26CD5051F6028D545FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  4d5fdf61242476e6f4b76c196754f55c15aec0e123f495298632181c5744e326.elf
- Size 91KB
- SHA256 4d5fdf61242476e6f4b76c196754f55c15aec0e123f495298632181c5744e326
- MD5 388b60ff8cd07fb544be1a8a89968e97
- SHA1 d83fd0d574bc591e687e51be1ce623e8f97b4abd
- SHA512 1bd4384c87ff364a4b05fb4f0434effba5c4bb2b25b2fa727bf1a93307c662396c90e2076d589f47ca75ba8b19a42771270bdb2b02445a4997a157c67bbbe6b1
- SSDEEP 1536:jUKvjDS4yb87YHgtyGpZxRIMUbXyYpvaQchpA/xHip+zDe0wPv4Ox:xvnyb87YHgtpRIMYvoAeMQdx
- TLSH
  T1C793C55E2E319FBEF76CC23C4BB34A31A26963D923E096C1D26CD5051F6028D545FBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery
- Contacts a large (48328) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Deletes Audit logs
  Deletes logs related to the Linux Audit framework.
  defense_evasion
- Deletes system logs
  Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
  defense_evasion
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads process memory
  Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
  credential_access
behavioral1