263b7939cd8af89303f2abae20e42312baff80ed659977427486c267ec77114f

General

Target
f5ce482ff608d05bb2f19845b7bf6f4573ba6f426075df99fba024752e628b96.elf
Size 550KB
Sample261110-pxewlsfd72
SHA256 263b7939cd8af89303f2abae20e42312baff80ed659977427486c267ec77114f
MD5 a3fd85295b5839fc7c252671c9d9c16e
SHA1 9fdf75c0312559590558b7afe12c3bbf4045a399
SHA512 9c4a2d6dab16636257d7b9ff389cce3ebb908ae9e3ad924b8751ed8864592ee9aea3db07e851cb83b103ac338afb7b43108a7046ee8436f3c3db3eeba9b258d6
SSDEEP 12288:TOOyLDMjVTlmgOJEX8iyHgNL7I+U8IY5cWt6InbW0ajFy:nyUXXzvpNnbW0aj
TLSH
T1A5C41A66F950D722C6C426BABA5DC2AC33131FB4D6EA3001FD147F2827FA91E4B36651
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  f5ce482ff608d05bb2f19845b7bf6f4573ba6f426075df99fba024752e628b96.elf
- Size 550KB
- SHA256 263b7939cd8af89303f2abae20e42312baff80ed659977427486c267ec77114f
- MD5 a3fd85295b5839fc7c252671c9d9c16e
- SHA1 9fdf75c0312559590558b7afe12c3bbf4045a399
- SHA512 9c4a2d6dab16636257d7b9ff389cce3ebb908ae9e3ad924b8751ed8864592ee9aea3db07e851cb83b103ac338afb7b43108a7046ee8436f3c3db3eeba9b258d6
- SSDEEP 12288:TOOyLDMjVTlmgOJEX8iyHgNL7I+U8IY5cWt6InbW0ajFy:nyUXXzvpNnbW0aj
- TLSH
  T1A5C41A66F950D722C6C426BABA5DC2AC33131FB4D6EA3001FD147F2827FA91E4B36651
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

antivm credential_access defense_evasion discovery
- Contacts a large (1044) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Deletes Audit logs
  Deletes logs related to the Linux Audit framework.
  defense_evasion
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Traces itself
  Traces itself to prevent debugging attempts
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Reads MAC address of network interface
  Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
  defense_evasion discovery
- Reads process memory
  Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
  credential_access
behavioral1