General
- Target x86_64.elf
- Size 184KB
- Sample261023-s676asdb75
- SHA256 03b40131a41aa9da237b6abd86d978324cf3351cb309ad4f914954f4b86a8560
- MD5 8908c2b0ddc1f1e0b6f3509ac3748630
- SHA1 2a0c4c356866b2219af63d9ac51a3ea7d1e6539e
- SHA512 5cc7a9ce961cd46e01c594bc45909efc8714d0b44089ae4b8ac793fd17b01c5792d60d590545ab6ed9d9727678d343b74a74a816b3361738f71a183876969332
- SSDEEP 3072:uTDkPUgGnDtwSVPtcKbmYFi1gFjyjalapHGjlhraefNd5jKkB:uTDkcdnDPSZe5lapslhracd5GkB
- TLSH T182044C07BAD154FDC49BD1708B6FD627A932B8D912303E7E2758AE741E25E602B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
x86_64.elf
Resource
ubuntu1804-amd64-20261019-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target x86_64.elf
- Size 184KB
- SHA256 03b40131a41aa9da237b6abd86d978324cf3351cb309ad4f914954f4b86a8560
- MD5 8908c2b0ddc1f1e0b6f3509ac3748630
- SHA1 2a0c4c356866b2219af63d9ac51a3ea7d1e6539e
- SHA512 5cc7a9ce961cd46e01c594bc45909efc8714d0b44089ae4b8ac793fd17b01c5792d60d590545ab6ed9d9727678d343b74a74a816b3361738f71a183876969332
- SSDEEP 3072:uTDkPUgGnDtwSVPtcKbmYFi1gFjyjalapHGjlhraefNd5jKkB:uTDkcdnDPSZe5lapslhracd5GkB
- TLSH T182044C07BAD154FDC49BD1708B6FD627A932B8D912303E7E2758AE741E25E602B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
2RC Scripts
2Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
2RC Scripts
2Scheduled Task/Job
1Cron
1