Overview

overview

9

Static

static

4146dffda8...2b.elf

debian-9-mipsel

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4146dffda8c8e8e55235e7b4a1debe2b.elf

  • Size

    172KB

  • Sample

    221204-rykvcsgg45

  • MD5

    4146dffda8c8e8e55235e7b4a1debe2b

  • SHA1

    2d3f3095788f4d25eed9a0517ef7d17cf44d0dfa

  • SHA256

    7355235899e9f4d7748af971331940dab4b8c5f15130d756fde3a1d6a2bcb1ab

  • SHA512

    a756ff3e7448e0ebd125c6063b2db95aa868cfc337932d159298b282174a25bf4a7f54988a7b0f89c7a2c78787e8f8021b9eb8396847a6a80102160561bb6097

  • SSDEEP

    1536:H+RnMzT1USPF5ogwFF0l+N7ERqCon0wZC0Zw1vG4:4wTjPjoD08N7ERb4ZC0ML

Score
9/10
antivmdiscovery

Malware Config

Targets

    • Target

      4146dffda8c8e8e55235e7b4a1debe2b.elf

    • Size

      172KB

    • MD5

      4146dffda8c8e8e55235e7b4a1debe2b

    • SHA1

      2d3f3095788f4d25eed9a0517ef7d17cf44d0dfa

    • SHA256

      7355235899e9f4d7748af971331940dab4b8c5f15130d756fde3a1d6a2bcb1ab

    • SHA512

      a756ff3e7448e0ebd125c6063b2db95aa868cfc337932d159298b282174a25bf4a7f54988a7b0f89c7a2c78787e8f8021b9eb8396847a6a80102160561bb6097

    • SSDEEP

      1536:H+RnMzT1USPF5ogwFF0l+N7ERqCon0wZC0Zw1vG4:4wTjPjoD08N7ERb4ZC0ML

    Score
    9/10
    antivmdiscovery

    • Attempts to identify hypervisor via CPU configuration

      Checks CPU information for indicators that the system is a virtual machine.

      antivm

    • Modifies the Watchdog daemon

      Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

    • Writes file to system bin folder

    • Write file to user bin folder

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks