f8860b8c5911535e4239d750861c4487bc784c4b38b9d120254bf65be2295864

Analysis

max time kernel
4800s
max time network
153s
platform
debian-9_armhf
resource
debian9-armhf-20221111-en
resource tags

arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
06-01-2023 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed5e0d6c386f7710dafc02947bf59d82.elf
Size

72KB
MD5

ed5e0d6c386f7710dafc02947bf59d82
SHA1

e5fa0f443d0be95814c71058e8e688df158e3b6c
SHA256

f8860b8c5911535e4239d750861c4487bc784c4b38b9d120254bf65be2295864
SHA512

f848b1169820730672c676a36469524c31af9850d374e01143194c269f8777013c18a34127f420c7a24c8c3029e7cba9c49c3b4569cf1c763c97f257e09e7f0d
SSDEEP

1536:XXnecCqpoAvpR9CWqrfp0W8a2pVnRZ3V92wiUyBTYM287OFJv3j2:+ctz13/3Ow77fS

Score

9^/10

discovery

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

Impair Defenses
T1562

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc
/sbin/watchdog	/sbin/watchdog
/bin/watchdog	/bin/watchdog

Reads runtime system information 47 IoCs

Reads data from /proc virtual filesystem.

description	ioc
/proc/498/cmdline	/proc/498/cmdline
/proc/509/cmdline	/proc/509/cmdline
/proc/410/cmdline	/proc/410/cmdline
/proc/439/cmdline	/proc/439/cmdline
/proc/485/cmdline	/proc/485/cmdline
/proc/507/cmdline	/proc/507/cmdline
/proc/505/cmdline	/proc/505/cmdline
/proc/508/cmdline	/proc/508/cmdline
/proc/511/cmdline	/proc/511/cmdline
/proc/427/cmdline	/proc/427/cmdline
/proc/431/cmdline	/proc/431/cmdline
/proc/472/cmdline	/proc/472/cmdline
/proc/479/cmdline	/proc/479/cmdline
/proc/433/cmdline	/proc/433/cmdline
/proc/473/cmdline	/proc/473/cmdline
/proc/477/cmdline	/proc/477/cmdline
/proc/503/cmdline	/proc/503/cmdline
/proc/488/cmdline	/proc/488/cmdline
/proc/495/cmdline	/proc/495/cmdline
/proc/497/cmdline	/proc/497/cmdline
/proc/514/cmdline	/proc/514/cmdline
/proc/420/cmdline	/proc/420/cmdline
/proc/461/cmdline	/proc/461/cmdline
/proc/478/cmdline	/proc/478/cmdline
/proc/480/cmdline	/proc/480/cmdline
/proc/515/cmdline	/proc/515/cmdline
/proc/492/cmdline	/proc/492/cmdline
/proc/499/cmdline	/proc/499/cmdline
/proc/510/cmdline	/proc/510/cmdline
/proc/513/cmdline	/proc/513/cmdline
/proc/	/proc/
/proc/401/cmdline	/proc/401/cmdline
/proc/483/cmdline	/proc/483/cmdline
/proc/486/cmdline	/proc/486/cmdline
/proc/489/cmdline	/proc/489/cmdline
/proc/490/cmdline	/proc/490/cmdline
/proc/491/cmdline	/proc/491/cmdline
/proc/501/cmdline	/proc/501/cmdline
/proc/475/cmdline	/proc/475/cmdline
/proc/481/cmdline	/proc/481/cmdline
/proc/484/cmdline	/proc/484/cmdline
/proc/487/cmdline	/proc/487/cmdline
/proc/506/cmdline	/proc/506/cmdline
/proc/512/cmdline	/proc/512/cmdline
/proc/451/cmdline	/proc/451/cmdline
/proc/493/cmdline	/proc/493/cmdline
/proc/494/cmdline	/proc/494/cmdline

/tmp/ed5e0d6c386f7710dafc02947bf59d82.elf
/tmp/ed5e0d6c386f7710dafc02947bf59d82.elf
1⤵
PID:361

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Impair Defenses

T1562

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads