Analysis
-
max time kernel
25446s -
max time network
158s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
resource tags
-
submitted
29-09-2022 05:14
General
-
Target
88d511c91f6d3d5895a51781449401be.elf
-
Size
177KB
-
MD5
88d511c91f6d3d5895a51781449401be
-
SHA1
294b41a47ebbb8dfa746effad2e80a91ca811c59
-
SHA256
81aa1a7b60d466d637169a22171c8762e45043b694b68c6fd7987d1ac15b7f64
-
SHA512
6aa90e261dabf7e71ed41e58bfccca22a5a95583f756daaf22beaab0ab7f986f16b90e193965934581fb455fbd9a7772423a3bbf8f724e33d2ab18e8b81ef34a
-
SSDEEP
3072:6PC+RjGkWa6s/qSPeAjQM6PBtjYbPOgpM/9sAfymUwwFB7DXNu:61fWa6s/qSGAYPBVYbPOqM/9sAfymUwr
Score
9/10
Malware Config
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/88d511c91f6d3d5895a51781449401be.elf/tmp/88d511c91f6d3d5895a51781449401be.elf1⤵
- Reads system routing table
- Reads system network configuration