6cacae2a726d74c06d48a96f96189b1cd0474154ea7eaef4f24790bcaa9332bf

Analysis

max time kernel
1039s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20221111-en
resource tags

arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23-11-2022 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee1e3bfed6bf2eeb29a01d514071759d.elf
Size

68KB
MD5

ee1e3bfed6bf2eeb29a01d514071759d
SHA1

2e64c01aa9d54feefb93e95ed01889611fa48e4c
SHA256

6cacae2a726d74c06d48a96f96189b1cd0474154ea7eaef4f24790bcaa9332bf
SHA512

a04b8c6c733c457e124fae4eb6afd50de80e2a7f8761d5e372ec7f4218f448eebfa381f0ec32e9b2d47d4fbfd7c07dacf0358445efd978d3d2beabe76d04ba2e
SSDEEP

1536:H4EqMiWN37fPlROoXumPr2zTsiRMSxnhIrSbQhM8WIaricCpYgJKc:H/bDXlRmQr2UX8nCrS8hM8RsNqYgYc

Score

9^/10

Malware Config

Signatures

Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc
/bin/watchdog	/bin/watchdog
/sbin/watchdog	/sbin/watchdog

Modifies hosts file 2 IoCs

Adds to hosts file used for mapping hosts to IP addresses.

description	ioc	Process
/etc/hosts	/etc/hosts	wget
/etc/hosts	/etc/hosts	wget

Writes DNS configuration 1 TTPs 2 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

description	ioc	Process
/etc/resolv.conf	/etc/resolv.conf	wget
/etc/resolv.conf	/etc/resolv.conf	wget

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery

T1016

description	ioc	Process
/proc/net/route	/proc/net/route	ee1e3bfed6bf2eeb29a01d514071759d.elf

Reads system network configuration 1 TTPs 3 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
/proc/net/route	/proc/net/route	ee1e3bfed6bf2eeb29a01d514071759d.elf
/proc/net/cmdline	/proc/net/cmdline	Process not Found
/proc/net/maps	/proc/net/maps	Process not Found

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc
/proc/26769/	/proc/26769/
/proc/38117/	/proc/38117/
/proc/83732/	/proc/83732/
/proc/91372/	/proc/91372/
/proc/9854/	/proc/9854/
/proc/62541/	/proc/62541/
/proc/67794/	/proc/67794/
/proc/12440/	/proc/12440/
/proc/40224/	/proc/40224/
/proc/64123/	/proc/64123/
/proc/75078/	/proc/75078/
/proc/3699/	/proc/3699/
/proc/3987/	/proc/3987/
/proc/4549/	/proc/4549/
/proc/56141/	/proc/56141/
/proc/66514/	/proc/66514/
/proc/21220/	/proc/21220/
/proc/28082/	/proc/28082/
/proc/41352/	/proc/41352/
/proc/94739/	/proc/94739/
/proc/98324/	/proc/98324/
/proc/3815/	/proc/3815/
/proc/62359/	/proc/62359/
/proc/81250/	/proc/81250/
/proc/39056/	/proc/39056/
/proc/62307/	/proc/62307/
/proc/64276/	/proc/64276/
/proc/88613/	/proc/88613/
/proc/19611/	/proc/19611/
/proc/22108/	/proc/22108/
/proc/22177/	/proc/22177/
/proc/88537/	/proc/88537/
/proc/16253/	/proc/16253/
/proc/56964/	/proc/56964/
/proc/84205/	/proc/84205/
/proc/48943/	/proc/48943/
/proc/56061/	/proc/56061/
/proc/59470/	/proc/59470/
/proc/64352/	/proc/64352/
/proc/70459/	/proc/70459/
/proc/9408/	/proc/9408/
/proc/17555/	/proc/17555/
/proc/28757/	/proc/28757/
/proc/81369/	/proc/81369/
/proc/82906/	/proc/82906/
/proc/15555/	/proc/15555/
/proc/54961/	/proc/54961/
/proc/67731/	/proc/67731/
/proc/73368/	/proc/73368/
/proc/78227/	/proc/78227/
/proc/1841/	/proc/1841/
/proc/2837/	/proc/2837/
/proc/15025/	/proc/15025/
/proc/79751/	/proc/79751/
/proc/83039/	/proc/83039/
/proc/83495/	/proc/83495/
/proc/60542/	/proc/60542/
/proc/83940/	/proc/83940/
/proc/23415/	/proc/23415/
/proc/30006/	/proc/30006/
/proc/45909/	/proc/45909/
/proc/27254/	/proc/27254/
/proc/38519/	/proc/38519/
/proc/57192/	/proc/57192/

/tmp/ee1e3bfed6bf2eeb29a01d514071759d.elf
/tmp/ee1e3bfed6bf2eeb29a01d514071759d.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:353

/bin/sh
sh -c "/bin/busybox wget 2>&1"
1⤵
PID:373
- /bin/busybox
  /bin/busybox wget
  2⤵
  PID:374

/bin/sh
sh -c "wget https://urlhaus.abuse.ch/downloads/text_online/ -q"
1⤵
PID:375
- /usr/bin/wget
  wget https://urlhaus.abuse.ch/downloads/text_online/ -q
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:376

/bin/sh
sh -c "/bin/busybox wget 2>&1"
1⤵
PID:383
- /bin/busybox
  /bin/busybox wget
  2⤵
  PID:384

/bin/sh
sh -c "wget https://urlhaus.abuse.ch/downloads/text_online/ -q"
1⤵
PID:385
- /usr/bin/wget
  wget https://urlhaus.abuse.ch/downloads/text_online/ -q
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:386