Analysis
-
max time kernel
3401s -
max time network
149s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20221111-en -
resource tags
arch:mipselimage:debian9-mipsel-20221111-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
21-12-2022 02:54
Behavioral task
behavioral1
Sample
5f0a4ef2da06e574b738af9d73c9f043.elf
Resource
debian9-mipsel-20221111-en
debian-9-mipsel
4 signatures
150 seconds
General
-
Target
5f0a4ef2da06e574b738af9d73c9f043.elf
-
Size
386KB
-
MD5
5f0a4ef2da06e574b738af9d73c9f043
-
SHA1
5bae45f0591c44b5a80ca5f1666fe0f2cf06e7fc
-
SHA256
b7e933e7cf23f0932c64e67df58deeb00b2e8af655e7aa679239c633018c5499
-
SHA512
b7eb3478b1eec014b8c624e767958d349066e524a1f9b7072472e6876de2e50f332c0cbd35142147ab8e10469bd059d88ec93864e22ff84dcbd121431da1579c
-
SSDEEP
6144:tYGZk5LrnUri1QwkehG37GWbdThzhvnJu81Vn6A914/tT30D:ypWi1QwYSQNhvnJu81Vn6A914/tT30D
Score
9/10
Malware Config
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 1 IoCs
description ioc /bin/watchdog /bin/watchdog -
Modifies rc script 1 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc /etc/rc.d/rc.local /etc/rc.d/rc.local -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process /proc/81/maps /proc/81/maps Process not Found /proc/307/maps /proc/307/maps Process not Found /proc/338/maps /proc/338/maps Process not Found /proc/11/cmdline /proc/11/cmdline Process not Found /proc/79/cmdline /proc/79/cmdline Process not Found /proc/10/cmdline /proc/10/cmdline Process not Found /proc/23/cmdline /proc/23/cmdline Process not Found /proc/71/maps /proc/71/maps Process not Found /proc/9/cmdline /proc/9/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/110/cmdline /proc/110/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/69/cmdline /proc/69/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/82/cmdline /proc/82/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/self/cmdline /proc/self/cmdline Process not Found /proc/6/maps /proc/6/maps Process not Found /proc/74/cmdline /proc/74/cmdline Process not Found /proc/260/maps /proc/260/maps Process not Found /proc/22/cmdline /proc/22/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/67/cmdline /proc/67/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/261/cmdline /proc/261/cmdline Process not Found /proc/74/cmdline /proc/74/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/11/maps /proc/11/maps Process not Found /proc/14/maps /proc/14/maps Process not Found /proc/22/cmdline /proc/22/cmdline Process not Found /proc/239/cmdline /proc/239/cmdline Process not Found /proc/240/maps /proc/240/maps Process not Found /proc/5/cmdline /proc/5/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/11/cmdline /proc/11/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/340/maps /proc/340/maps Process not Found /proc/342/cmdline /proc/342/cmdline Process not Found /proc/121/cmdline /proc/121/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/269/cmdline /proc/269/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/5/cmdline /proc/5/cmdline Process not Found /proc/76/cmdline /proc/76/cmdline Process not Found /proc/229/maps /proc/229/maps Process not Found /proc/230/maps /proc/230/maps Process not Found /proc/4/cmdline /proc/4/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/19/cmdline /proc/19/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/295/cmdline /proc/295/cmdline Process not Found /proc/7/cmdline /proc/7/cmdline Process not Found /proc/9/maps /proc/9/maps Process not Found /proc/15/cmdline /proc/15/cmdline Process not Found /proc/68/cmdline /proc/68/cmdline Process not Found /proc/308/maps /proc/308/maps Process not Found /proc/308/cmdline /proc/308/cmdline Process not Found /proc/ /proc/ 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/229/cmdline /proc/229/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/342/maps /proc/342/maps Process not Found /proc/10/maps /proc/10/maps Process not Found /proc/23/maps /proc/23/maps Process not Found /proc/6/cmdline /proc/6/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/14/cmdline /proc/14/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/338/cmdline /proc/338/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/8/cmdline /proc/8/cmdline Process not Found /proc/16/maps /proc/16/maps Process not Found /proc/19/maps /proc/19/maps Process not Found /proc/20/maps /proc/20/maps Process not Found /proc/24/cmdline /proc/24/cmdline Process not Found /proc/7/cmdline /proc/7/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/295/cmdline /proc/295/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf /proc/299/maps /proc/299/maps Process not Found /proc/299/cmdline /proc/299/cmdline Process not Found /proc/67/cmdline /proc/67/cmdline Process not Found /proc/229/cmdline /proc/229/cmdline Process not Found /proc/239/cmdline /proc/239/cmdline 5f0a4ef2da06e574b738af9d73c9f043.elf