3435fc10f8fe034166c954a9b8a39e24bdfa2dec6d21e08dd2cf5be232a47899

Analysis

max time kernel
30404s
max time network
152s
platform
linux_mipsel
resource
debian9-mipsel-en-20211208
resource tags

arch:mipselimage:debian9-mipsel-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
25/11/2022, 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3435fc10f8fe034166c954a9b8a39e24bdfa2dec6d21e08dd2cf5be232a47899
Size

48KB
MD5

886f05591c197c28accea96d35e7e0d5
SHA1

2a9bdf49cd2e807ebdf014ede8a7cc3e65110ebb
SHA256

3435fc10f8fe034166c954a9b8a39e24bdfa2dec6d21e08dd2cf5be232a47899
SHA512

c37b2b976b36314a5492efa1140c9db100cf5d6848b8775223d13d0723c72cbe05dad263e153ce32be13393735872c06e83198ba889afc31c3d9934d091a358d
SSDEEP

768:CC/vVNNIgETs7EL7yqjrZEp6evOTVEt1dwXUBnu8IdjBVCQtggqMpWRh:CsVIgooE/1jWptWT2tjHIdHC2gJM0

Score

9^/10

Malware Config

Signatures

Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Writes file to system bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc
/bin/watchdog	/bin/watchdog

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

description	ioc
/proc/net/tcp	/proc/net/tcp

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
/proc/net/tcp	/proc/net/tcp

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/	/proc/	Process not Found
/proc/self/exe	/proc/self/exe	3435fc10f8fe034166c954a9b8a39e24bdfa2dec6d21e08dd2cf5be232a47899
/proc/325/exe	/proc/325/exe	Process not Found

/tmp/3435fc10f8fe034166c954a9b8a39e24bdfa2dec6d21e08dd2cf5be232a47899
/tmp/3435fc10f8fe034166c954a9b8a39e24bdfa2dec6d21e08dd2cf5be232a47899
1⤵
- Reads runtime system information
PID:323

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads